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PURCHASE CARDS 

Control Weaknesses Leave DHS Highly 
Vulnerable to Fraudulent, Improper, and 
Abusive Activity 



Why GAO Did This Study 

In the wake of the 2005 hurricanes 
in the Gulf Region, GAO and the 
Department of Homeland Security 
Office of Inspector General (DHS 
OIG) initiated a number of audits 
and investigations addressing the 
federal government's response to 
those events. On July 19, 2006, 
GAO testified on the results of its 
purchase card work. This report 
summarizes the testimony and 
provides recommendations. 

Department of Homeland Security 
(DHS) cardholders made 
thousands of transactions related 
to hurricane relief operations. GAO 
analyzed transactions between 
June and November of 2005 to 
determine if (1) DHS's control 
environment and management of 
purchase card usage were 
effective; (2) DHS's key internal 
control activities operated 
effectively and provided reasonable 
assurance that purchase cards 
were used appropriately; and 
(3) potentially fraudulent, 
improper, and abusive purchase 
card activity existed at DHS. 



What GAO Recommends 



To provide reasonable assurance 
that fraud, waste, and abuse related 
to the use of purchase cards is 
minimized, GAO recommends that 
DHS (1) make changes to the draft 
purchase card manual and issue a 
final, agencywide version (2) 
establish policies and procedures 
to ensure more effective oversight 
and enforcement of the purchase 
card program. DHS concurred with 
all of our recommendations. 

www.gao.gov/cgi-bin/getrpt7GAO-06-1 1 1 7. 
To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact Greg Kutz at 
(202) 512-7455 or kutzg@gao.gov or 
Matthew Jadacki at (202) 254-4100 or 
matt.jadacki@dhs.gov. 



What GAO Found 

A weak control environment and breakdowns in key controls exposed DHS 
to fraud and abuse in its use of the purchase card. While DHS's draft 
Purchase Card Manual generally contained effective control procedures, it 
was not finalized due to a lack of leadership by the Chief Financial Officer in 
resolving disagreements over its implementation. This led to DHS 
cardholders following different procedures. Inadequate staffing, insufficient 
training, and ineffective monitoring, along with inconsistent purchase card 
policies contributed to a weak control environment and breakdowns in 
specific key controls. GAO and DHS OIG found a lack of documentation that 
key purchase card internal controls were performed. Based on a statistical 
sample, GAO and DHS OIG estimated that 45 percent of DHS's purchase 
card transactions were not properly authorized, 63 percent did not have 
evidence that the goods or services were received, and 53 percent did not 
give priority to designated procurement sources. GAO and DHS OIG also 
found cardholders who failed to dispute improper charges, which resulted in 
losses to the federal government. Because of the urgent needs caused by the 
hurricanes, DHS made a number of noncompetitive purchase card 
acquisitions. GAO recognizes that DHS had the authority to make 
noncompetitive purchases; however, GAO found transactions where DHS 
cardholders could have exercised greater prudence without jeopardizing 
relief efforts. 

The weak control environment and ineffective internal control activities 
allowed potentially fraudulent, improper, and abusive or questionable 
transactions to occur. Although this work was not designed to identify, and 
we cannot determine the full extent of fraud, waste, and abuse, GAO and the 
DHS OIG identified numerous examples of potentially fraudulent, improper, 
and abusive or questionable transactions. The table below lists examples of 
potentially fraudulent activity related to items acquired with DHS purchase 
cards. In addition, poor control over accountable property acquired with 
purchase cards may have resulted in lost or misappropriated assets. 



Examples of Potential Fraud 


Item Purchased 


Description 


Amount of Transaction 


Lap Tops (FEMA) 


Over 100 missing and presumed stolen 


$300,000 


Boats (FEMA) 


Unauthorized use of card by a vendor 


$208,000 


Printers (FEMA) 


Over 20 missing and presumed stolen 


$84,000 


Lap Tops (Coast Guard) 


3 missing and reported stolen 


$8,000 



Source: GAO and DHS OIG. 



GAO and DHS OIG also found examples of improper use of the purchase 
card such as the use of convenience checks to pay $460,000 for pre-packaged 
meals. Other instances of abusive or questionable transactions included the 
purchase of a beer brewing kit, a 63-inch plasma television costing $8,000 
which was found unused in its original box 6 months after being purchased, 
and tens of thousands of dollars for training at golf and tennis resorts. GAO 
referred cardholders responsible for many of these and other purchases to 
DHS management for administrative action. 
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United States Government Accountability Office 
Washington, D.C. 20548 



September 28, 2006 
Congressional Committees 

On July 19, 2006, GAO testified before the Committee on Homeland 
Security and Governmental Affairs on the results of our audit and 
investigation of purchase card transactions at the Department of Homeland 
Security (DHS) for the 5-month period beginning in June 2005. 1 The 
General Service Administration's SmartPay® purchase card program has 
proven to be a valuable tool for the government by providing federal 
agencies and their employees a more flexible and efficient way to purchase 
commercial goods and services. However, to ensure the most effective use 
of the purchase card, federal agencies must foster a strong control 
environment and establish sound internal controls related to the use of the 
card. To this end, agencies must establish policies and procedures that 
ensure appropriate oversight of their purchase card programs. Our work 
focused on determining whether (1) DHS's control environment and 
management of purchase card usage were effective; (2) DHS's key internal 
control activities operated effectively and provided reasonable assurance 
that purchase cards were used appropriately; and (3) potentially 
fraudulent, improper, and abusive or questionable purchase card activity 
existed at DHS. 

This report summarizes the GAO testimony, which is reprinted in appendix 
I, and makes specific recommendations for corrective actions. We hope 
that these recommendations; the criminal referrals we provided to the 
Katrina Fraud Task Force, the Coast Guard Investigative Service, and the 
Federal Bureau of Investigation; as well as the administrative referrals we 
provided to DHS serve to assist DHS in its ongoing effort to improve the 
purchase card program. We conducted our audit work from November 
2005 through June 2006 in accordance with U.S. generally accepted 
government auditing standards. We performed our investigative work in 
accordance with standards prescribed by the President's Council on 
Integrity and Efficiency. 



'GAO, Purchase Cards: Control Weaknesses Leave DHS Highly Vulnerable to Fraudulent, 
Improper, and Abusive Activity, GAO-06-957T (Washington, D.C: July 19, 2006). 
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In our testimony, we stated that a weak control environment and 
breakdowns in key controls exposed DHS to fraud, waste, and abuse in its 
purchase card program. While DHS's draft Purchase Card Manual 
generally incorporated adequately designed controls, disagreements 
among DHS organizational elements concerning the implementation of the 
manual prevented a final copy from being issued. As a result of DHS not 
finalizing the Purchase Card Manual and not making it applicable to all 
organizational elements within DHS, a weak control environment resulted 
where cardholders adopted inconsistent and inadequate purchase card 
practices. For example, some cardholders at the U.S. Coast Guard believed 
that obtaining written authorization prior to purchase was required while 
others did not. 

The testimony described how inadequate staffing and ineffective 
monitoring contributed to a weak control environment, which, in addition 
to the prevalence of thousands of unused purchase cards, left DHS 
vulnerable to fraud, waste, and abuse. DHS had roughly 13,900 purchase 
cards but failed to assign sufficient resources to manage its purchase card 
program as evidenced by the fact that we found numerous instances where 
approving officials assumed oversight responsibilities for an excessive 
number of cardholders. We found, for example, three approving officials 
who were responsible for more than 30 cardholders each. In contrast, GAO 
has issued an audit guide 2 prescribing that the ratio of cardholders to 
approving officials should not exceed seven to one. As an example of 
ineffective monitoring, we found that the U.S. Coast Guard has only one 
individual responsible for administering and overseeing its purchase card 
activity, which totaled over $227 million in goods and services with their 
purchase cards in fiscal year 2005. 

Further, our testimony showed that we were unable to obtain evidence to 
confirm that DHS is providing appropriate training to enable cardholders to 
be aware of and follow internal controls related to use of the purchase 
card. We found that for 60 of the 96 transactions in our statistical sample, 
the cardholder lacked documentation showing that they received either the 
required initial training or the refresher training. Without adequate training, 
DHS can not expect cardholders and approving officials to understand and 



Overview of Testimony 



2 GAO, Audit Guide: Auditing and Investigating the Internal Control of Government 
Purchase Card Programs, GAO-04-87G (Washington, D.C.: Nov. 1, 2003). 
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comply with purchase card policies, thus elevating the risk associated with 
card usage. 

Our testimony also described DHS's failure to conduct timely and effective 
postpayment audits. The postpayment audit is conducted by DHS after 
cardholders have made purchases and requires that cardholders submit 
purchase-related documentation for transactions selected for audit. We 
also found that DHS failed to suspend cards and discipline cardholders 
who did not provide the required supporting documentation for audit. 
Without a strong postpayment audit process, DHS is not able to obtain 
reasonable assurance that purchases are valid and appropriate, which 
needlessly exposes DHS to additional risk of fraud, waste, and abuse. 

GAO and DHS's Office of Inspector General (DHS OIG) performed 
statistical testing on purchase card transactions and identified weak 
implementation of several key internal controls. On the basis of a statistical 
sample of DHS's purchase card transactions for a 5-month period beginning 
in June 2005, we estimated that 45 percent lacked prior written 
authorization, 8 percent failed to provide required sales documentation, 63 
percent lacked documentation evidencing proper receipt and acceptance, 
and 53 percent did not give priority to designated sources. 

Our work also identified specific incidents of (1) potentially fraudulent, 
(2) improper, and (3) abusive or questionable purchases made by DHS 
cardholders. A U.S. Coast Guard employee potentially committed fraud by 
misappropriating laptops and then falsifying records to hide the fraud. As 
an example of an improper purchase, we identified an instance where a 
DHS cardholder failed to dispute an improper transaction in a timely 
manner, resulting in losses to the federal government of $153,000. Also, a 
U.S. Coast Guard cardholder used his purchase card to acquire a beer 
brewing kit — a questionable use of taxpayer money. 

Further, we found purchases where DHS cardholders failed to adopt 
prudent pricing practices, resulting in waste of government funds. 
Although DHS had the authority to make noncompetitive purchases in 
response to the hurricanes in the Gulf Region, GAO identified instances 
where DHS cardholders could have saved the government money by 
purchasing items from GSA vendors, or by using the government's 
substantial purchasing power to negotiate better pricing and or delivery 
terms. In one case, a Federal Emergency Management Agency (FEMA) 
cardholder used his purchase card to acquire flat-bottom boats at double 
the retail price. We also found unnecessary purchases due to procurement 
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problems. For example, a FEMA cardholder unnecessarily purchased 
items totaling $68,000 that was inadvertently included on a provision list. 
Although these procurement problems are not isolated to purchase card 
acquisitions, they do represent examples in which DHS cardholders used 
the government purchase card and wasted tax dollars. 

Finally, our testing found many instances where assets acquired using the 
purchase card were not promptly or accurately entered into a property 
tracking system. The way DHS used purchase cards to acquire accountable 
property allowed for such assets to be susceptible to the risk of not being 
properly tracked in the property system. As a result, we found a significant 
number of assets that DHS could not locate. By not following procedures to 
appropriately track assets in a property system, DHS is subject to greater 
risk of misappropriation of its assets. Of the 433 assets we attempted to 
locate and which were obtained with DHS purchase cards, 154 could not be 
located by GAO or DHS (e.g., boats, laptops, and printers). 



Conclusions ^he P urc h ase card has proven to be a valuable tool for the government to 

purchase commercial goods and services. However, empowering 
approximately 14,000 DHS cardholders with purchasing authority, while 
not implementing effective controls and performing adequate management 
oversight, allowed potentially fraudulent, improper, and abusive or 
questionable usage of purchase cards to go undetected. Many of the 
transactions we highlighted as examples of misuse of the purchase card in 
our testimony were related to hurricane response efforts in the Gulf 
Region, demonstrating that the government is particularly vulnerable when 
purchase cards are used during times of disaster and even more so if an 
effective internal control structure is not in place and faithfully 
implemented. Taking immediate actions to improve its purchase card 
program will help DHS maximize the value and benefit of the purchase card 
program and provide reasonable assurance that fraud, waste, and abuse are 
minimized. 



Recommendations for 
Executive Action 



To provide reasonable assurance that fraud, waste, and abuse related to 
DHS's purchase card program are minimized and that government assets 
acquired with purchase cards are controlled, we are making six 
recommendations. Specifically, we recommend that the Secretary of DHS 
take the following actions: 
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• Implement changes to DHS's draft Purchase Card Manual to include 
policies and procedures addressing the four areas detailed below. After 
implementing the changes, the Purchase Card Manual should be 
finalized agencywide. 

• Training: Establish policies and procedures that document that all 
cardholders have completed the appropriate training. The 
documentation should include the date of the training, a description 
of the training, and the name of the recipient of the training. 

• Independent Receipt and Acceptance: Develop policies and 
procedures for the performance and documentation of independent 
receipt and acceptance attesting to the receipt of goods or the 
complete rendering of services. This documentation would be 
maintained along with other required documentation supporting 
each transaction. 

• Accountable Property: Develop policies and procedures to provide 
reasonable assurance that highly pilferable assets such as laptop 
computers, cell phones, personal digital assistants, memory storage 
devices, and other pilferable property acquired with a purchase card 
are entered into an accountable property system immediately after 
being received. Cardholders should be required to contact 
accountable property officers (or others acting in a similar capacity) 
before acquiring accountable property, or within a reasonable time 
thereafter, so that the property is properly bar coded and tracked in 
the property system. This should be completed prior to placement of 
the asset in service. The property system should include accurate 
information on the location of the asset, the individual responsible 
for the asset, the manufacturer's serial number, as well as the 
agency's unique identification code for the asset (e.g., a bar code). 

• Disciplinary or Administrative Actions: The agency should 
develop a range of potential disciplinary and administrative actions 
that may occur as a result of a cardholder or others failing to comply 
with the policies and procedures in the Purchase Card Manual. 

• Improve the existing electronic systems to allow those with oversight 
responsibilities the ability to determine if cardholders and approving 
officials performed their reconciliation and certifying duties in a 
meaningful way. 
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• Conduct a review to determine if adequate resources are devoted to 
administering, maintaining, and enforcing the purchase card program at 
both the agency level and the organizational element level. DHS should 
further develop specific oversight responsibilities that need to be 
carried out at both the agency level and at the organizational element 
level. 

• Adopt prudent purchasing practices by entering into arrangements with 
dependable sources in the government or vendors who can provide 
reasonable pricing for specific goods and services with a foreseeable 
demand in the event of an emergency. In anticipation of future 
emergencies, DHS should take the following actions: 

• Identify specific sources in the federal government or vendors in the 
private sector that can reliably supply the necessary goods and 
services for DHS to accomplish its mission in emergency situations. 

• In the case of vendors in the private sector, negotiate pricing and 
delivery terms with these sources using the federal government's 
substantial purchasing power so that in a time of crisis DHS will be 
able to efficiently obtain the necessary goods and services. 

• Develop policies and procedures to limit approving officials' span of 
control. The number of cardholders and card accounts that any one 
approving official is responsible for should be reasonable and should be 
established in consideration of the approving official's other 
responsibilities. In addition, approving officials should have an 
appropriate number of transactions so that they may conduct a 
thorough and proper review of supporting documentation for each 
transaction. 

• Continuously monitor and review open accounts to provide reasonable 
assurance that only cardholders who have a documented need to 
acquire items for the government are issued a purchase card. Instances 
where cards have not been used for over a year should be analyzed to 
determine if a valid need for the card exists. If a valid need can not be 
established, the purchase card should be suspended or the account 
closed. 



AgGllCy Comments * n wr "itten comments dated September 15, 2006, on a draft of this report, 

° * DHS concurred with all of our recommendations. In the comments, which 
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are reprinted in appendix II, DHS stated that it has incorporated the 
relevant changes into its Purchase Card Manual and offered additional 
details on the actions it has taken or which it plans to take in the near 
future. 

Specifically, DHS offered the language it had added to the draft Purchase 
Card Manual relating to: training; independent receipt and acceptance; 
tracking of accountable property; disciplinary and administrative actions; 
and approving official span-of-control. Furthermore, and importantly, DHS 
issued the finalized DHS Purchase Card Manual on September 15, 2006, 
after incorporating the recommended changes. For other 
recommendations, DHS stated that it is working to develop policies and 
procedures to enhance its purchase card control environment. For 
example, DHS said it is working with its purchase card vendor to 
incorporate specific control activities into the automated system which will 
address the validity of cardholder reconciliations and approving official 
certifications. 



As agreed with your offices, we will send copies to interested 
congressional committees and the Office of the Chief Financial Officer at 
DHS. We will make copies available to others upon request. In addition, the 
report will be available at no charge on the GAO Web site at 
http://www.gao.gov. Please contact Gregory Kutz at (202) 512-7455 or 
kutzg@gao.gov, or Matt Jadacki at (202) 254-4100 or matt.jadacki@dhs.gov 
if you or your staffs have any questions concerning this report. Contact 
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points for our Offices of Congressional Relations and Public Affairs may be 
found on the last page of this report. 




Gregory D. Kutz 
Managing Director 

Forensic Audits and Special Investigations 




Matthew Jadacki 
Special Inspector General 
Department of Homeland Security 
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PURCHASE CARDS 

Control Weaknesses Leave DHS Highly 
Vulnerable to Fraudulent, Improper and 
Abusive Activity 



Why GAO Did This Study 

In the wake of the 2005 hurricanes 
in the Gulf Region, GAO and the 
Department of Homeland Security 
Office of Inspector General (DHS 
OIG) initiated a number of audits 
and investigations addressing the 
federal government's response to 
those events. 

Department of Homeland Security 
(DHS) cardholders made 
thousands of transactions related 
to hurricane rescue and relief 
operations. GAO, working with 
DHS OIG, interviewed DHS 
personnel and reviewed purchase 
card policies and procedures to 
assess the control environment. 
GAO and DHS OIG conducted 
statistical tests from a random 
sample of transactions and 
performed data mining on all DHS 
purchase card transactions for a 5- 
month period beginning in June 
2005. GAO and DHS OIG looked at 
all transactions in this period 
because the database did not 
distinguish hurricane related from 
routine purchases. GAO and DHS 
OIG used the testing results to 
determine the extent of control 
weaknesses and identify instances 
of fraud, waste, and abuse. 

This testimony addresses whether 
(1) DHS's control environment and 
management of purchase card 
usage were effective; (2) DHS's key 
internal control activities operated 
effectively and provided reasonable 
assurance that purchase cards 
were used appropriately; and (3) 
indications existed of potentially 
fraudulent, improper, and abusive 
or questionable purchase card 
activity at DHS. 
www.gao.gov/cgi-bin/getrpt?GAO-06-957T. 

To view the full product, click on the link 
above. For more information, contact Gregory 
D. Kutz at (202) 512-7455 or kutz@gao.gov 
and Matthew A. Jadacki at (202) 254-5477 or 
matt.jadacki@dhs.gov. 



What GAO Found 

A weak control environment and breakdowns in key controls exposed DHS 
to fraud and abuse in its use of the purchase card. While DHS's draft 
Purchase Card Manual generally contained effective control procedures, it 
was not finalized due to a lack of leadership by the CFO in resolving 
disagreements over its implementation. This led to DHS cardholders not 
following the same procedures. Inadequate staffing, insufficient training, and 
ineffective monitoring also contributed to the weak control environment. 
The weak control environment and inconsistent purchase card policies 
contributed to breakdowns in specific key controls. GAO and DHS OIG 
found a lack of documentation that key purchase card internal controls were 
performed. Based on a statistical sample, GAO and DHS OIG estimated that 
45 percent of DHS's purchase card transactions were not properly 
authorized, 63 percent did not have evidence that the goods or services were 
received, and 53 percent did not give priority to designated sources. GAO 
and DHS OIG also found cardholders who failed to dispute improper 
transactions, which resulted in losses to the federal government. Because of 
the urgent needs caused by the hurricanes, DHS made a number of 
noncompetitive purchase card acquisitions. GAO recognizes that DHS had 
the authority to make noncompetitive purchases; however, GAO found 
transactions where DHS cardholders could have exercised greater prudence 
without jeopardizing relief efforts. 

The weak control environment and ineffective internal control activities 
allowed potentially fraudulent, improper, and abusive or questionable 
transactions to occur. Although this work was not designed to identify, and 
we cannot determine, the full extent of fraud, waste, and abuse, GAO and 
DHS OIG identified numerous examples of potentially fraudulent, improper, 
and abusive or questionable transactions. The table below lists the 
potentially fraudulent activity related to items acquired with DHS purchase 
cards. In addition, poor control over accountable property acquired with 
purchase cards may have resulted in lost or misappropriated assets. 

Examples of Potential Fraud 



Item Purchased 


Description 


Amount of Transaction 


Lap Tops (FEMA) 


Over 100 missing and presumed stolen 


$300,000 


Boats (FEMA) 


Unauthorized use of card by a vendor 


$208,000 


Printers (FEMA) 


Over 20 missing and presumed stolen 


$84,000 


Lap Tops (Coast Guard) 


3 missing and reported stolen 


$8,000 



Source: GAO and DHS OIG investigation. 

GAO and DHS OIG also found examples of improper use of the purchase 
card such as the use of convenience checks to pay $460,000 for pre-packaged 
meals. Further, they found instances of abusive or questionable transactions 
that included the purchase of a beer brewing kit, a 63" plasma television 
costing $8,000 which was found unused in its original box 6 months after 
being purchased, and tens of thousands of dollars for training at golf and 
tennis resorts. GAO intends to refer the cardholders responsible for many of 
these and other purchases to DHS management for administrative action. 
United States Government Accountability Office 
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Madam Chairman and Members of the Committee: 

Thank you for the opportunity to discuss the results of the forensic audit and 
investigation of the Department of Homeland Security's (DHS) purchase card program, a 
joint audit by GAO and DHS's Office of Inspector General (DHS OIG). This joint audit is 
one among a number of audits and investigations that GAO and DHS OIG initiated in the 
wake of Hurricanes Katrina and Rita to review the effectiveness of the federal 
government's disaster response. A crucial tool DHS used to expedite the government's 
response to the two disasters was the SmartPay® purchase card program, a program 
implemented to provide federal agencies and their employees a more flexible and 
efficient way to purchase commercial goods and services. GAO and DHS OIG support 
the use of a well-controlled purchase card program, which our experience shows 
reduces transaction processing costs and provides agencies with flexibility to achieve 
their mission objectives. This testimony builds on GAO's substantial experience in 
identifying fraud, waste, and abuse in government purchase card programs (see app. I for 
previous audit reports) and DHS OIG's significant experience auditing one of our 
nation's largest federal agencies. 

With the creation of DHS in 2002, 1 the management of thousands of purchase 
cardholders from 22 separate federal agencies was combined under one umbrella 
program, the DHS Purchase Card Program. The legacy agencies such as the Federal 
Emergency Management Agency (FEMA), the U.S. Coast Guard (Coast Guard), and the 
U.S. Customs and Border Protection (CBP) are now referred to as DHS organizational 
elements. During fiscal year 2005, these organizational elements accumulated more than 
$420 million in charges, ranking DHS among the top purchase card users in the federal 
government. In response to Hurricanes Katrina and Rita, DHS made thousands of 
purchase card transactions to buy goods and services for hurricane rescue and relief 
operations. For Katrina-related procurements, Congress authorized an increase to the 

'The Homeland Security Act of 2002, Pub. L. No. 107-296, led to the creation in January 2003 of DHS— the most 
substantial reorganization of the federal government since the 1940s. The creation of DHS, which began operations 
in March 2003, represents the fusion of 22 federal agencies to coordinate and centralize the leadership of many 
homeland security activities under a single department. 
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Testimony GAO-06-957T 



micropurchase threshold from $2,500 to $250,000." When making micropurchases, 
authorized cardholders are not required to solicit competitive bids if they consider the 
price to be reasonable. For further details on the DHS purchase card program, see 
appendix JL 

Our testimony today addresses whether (1) DHS's control environment and management 
of the purchase card program were effective; (2) DHS's key control activities operated 
effectively and provided reasonable assurance that purchase cards were used 
appropriately; and (3) indications existed of potentially fraudulent, improper, and 
abusive or questionable activity related to items acquired with DHS purchase cards. 3 
Following this testimony, we plan to issue a joint report with recommendations to DHS 
for improving internal controls over its purchase card activities. 

The scope of our joint audit covered all DHS purchase card transactions from June 13, 
2005, through November 12, 2005. We selected all transactions during this period 
because we could not distinguish between routine and hurricane-related purchases in the 
database provided by U.S. Bank (DHS's purchase card contractor). To assess the design 
and implementation of controls over purchase card transactions, we conducted 
interviews of purchase card administrators and compared DHS's purchase card policies 
and procedures to the Office of Management and Budget's (OMB) Circular No. A- 123, 
G AO's Standards for Internal Controls in the Federal Government {Standards for 
Internal Controls) and to the best practices for purchase card programs outlined in 
GAO's Audit Guide: Auditing and Investigating the Internal Control of Government 
Purchase Card Programs (GAO's Audit Guide). Using purchase card data provided by 
U.S. Bank, we conducted statistical tests from a random sample of transactions and 

"Second Emergency Supplemental Appropriations Act to Meet Immediate Needs Arising from the Consequences of 
Hurricane Katrina, 2005, Pub. L. No. 109-62, Sec. 101 (Sept. 8, 2005). 

3 We considered potentially fraudulent purchases to be those which were unauthorized and intended for personal use. 
The transactions we determined to be improper are those purchases intended for government use, but are not for a 
purpose that is permitted by law, regulation, or policy. We also identified as improper a number of purchases made 
on the same day from the same vendor, and which appeared to circumvent cardholder single transaction limits or 
bidding requirements. We defined abusive transactions as those that may be authorized, but the items purchased 
were at an excessive cost or were not needed by the government, or both. Questionable transactions could be 
improper or abusive but for which there is insufficient documentation to conclude either. 
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performed other audit work to evaluate the design and implementation of key internal 
control activities. 

We also performed data mining on the transactions to determine whether there were 
potentially fraudulent, improper, abusive, or questionable activities related to the 
purchase card program. Our data mining efforts included reviewing and analyzing 
transactions to determine whether split payments occurred, 4 whether DHS maintained 
appropriate controls over property accountability, and whether DHS was able to 
leverage the hundreds of millions of dollars it spends with a purchase card to obtain 
favorable pricing from frequently used vendors, among others. We used forensic audit 
and investigative techniques to determine if the purchase card was used in a potentially 
fraudulent manner. Although we did identify some potentially fraudulent, improper, and 
abusive or questionable transactions, our work was not designed to identify, and we 
cannot determine, the extent of fraudulent, improper, and abusive or questionable 
transactions. See appendix III for further details on our scope and methodology. We 
conducted our audit work from November 2005 through June 2006 in accordance with 
U.S. generally accepted government auditing standards. We performed our investigative 
work in accordance with standards prescribed by the President's Council on Integrity 
and Efficiency. We briefed DHS on the details of our work, including our scope, and 
methodology and our findings. 



Summary 

A weak control environment and breakdowns in key internal controls exposed DHS to 
fraud, waste, and abuse in its purchase card program. Our review of DHS's draft 
Purchase Card Manual (draft manual) found that the draft manual generally 
incorporated well-designed internal controls for an agencywide purchase card program 
that were consistent with OMB's Circular No. A-123, GAO's Standards for Internal 



4 A split payment occurs when a cardholder splits a transaction into more than one segment to circumvent the 
requirement to obtain competitive prices for purchases over the $2,500 micropurchase threshold (in the case of 
Hurricanes Katrina and Rita, a micropurchase threshold of up to $250,000) or to avoid other established credit 
limits. 
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Controls, and the best practices for purchase card programs outlined in GAO's Audit 
Guide. 5 However, according to representatives from the Office of the Chief Financial 
Officer, the draft manual was not issued in its final format due to ongoing disagreements 
with DHS organizational elements over its implementation. Without a final policy, DHS 
organizational elements adopted inconsistent purchase card practices. Some 
organizational elements followed purchase card policies from their legacy agencies, 
others observed requirements from the draft DHS policy, and yet others relied on a 
combination. Overall, we found that a lack of leadership in finalizing the draft manual, 
inadequate resources devoted to the purchase card program, insufficient training, and 
ineffective monitoring and oversight each contributed to a weak control environment. 

We also found weaknesses in specific key control activities over purchase card 
transactions. Specifically, we found a lack of documentation that required internal 
controls over purchase card transactions were performed. Based on our sample of DHS 
purchase card transactions, we estimated that 45 percent did not have prior written 
authorization, 8 percent did not provide required sales documentation, 63 percent did not 
have evidence that the goods or services were actually received, and 53 percent did not 
give priority to required or preferred vendors (designated sources). We also found 
instances where DHS cardholders failed to dispute improper transactions, resulting in 
losses to the federal government from improper and potentially fraudulent purchases. 
Further, DHS did not invoke the special authority provided to increase the threshold for 
micropurchases from $2,500 to $250,000. Instead, DHS invoked other clauses in the 
Federal Acquisition Regulations (FAR) to make noncompetitive purchases under existing 
procurement authority. While we recognize that DHS has authority to make such 
noncompetitive purchases under the FAR, we identified transactions where DHS 
cardholders could have obtained better pricing without jeopardizing relief efforts or 
where the purchase was unnecessary. Later in our testimony, we identify examples of 



"Because we believe DHS's draft manual, Department of Homeland Security Purchase Card Manual (Washington, 
D.C.: Mar. S, 2004) is largely consistent with GAO's Audit Guide: Auditing and Investigating the Internal Control 
of Government Purchase Card Programs, GAO-04-87G (Washington, D.C.: Nov. 1, 2003) and Standards for 
Internal Control in the Federal Government, GAO/A1MD-00-2 1.3.1 (Washington, D.C. Nov. 1999), we generally 
used the draft manual as the criteria against which we tested internal controls. 
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poor pricing and unnecessary purchases, but also highlight instances where the 
cardholder acted prudently to obtain the best pricing. 

The weak control environment and weak implementation of specific internal control 
activities allowed potentially fraudulent, improper, abusive, or questionable transactions 
to go undetected. In one potential fraud case, ineffective procurement practices resulted 
in DHS paying double the retail price for 20 flat-bottom boats. The vendor in this case 
improperly used the DHS purchase card number to purchase boats from retailers before 
reselling them to DHS. In another potentially fraudulent case, breakdowns in property 
accountability controls allowed a DHS employee to submit falsified records related to 
three stolen laptops. As an example of improper use of a purchase card, we identified a 
cardholder who used convenience checks to pay a vendor who normally accepted credit 
cards but who did not want to pay credit card transaction fees for a large purchase — in 
which case the cardholder violated DHS policy. As a result of this policy violation, the 
DHS incurred $8,000 in unnecessary processing fees related to the use of convenience 
checks. 

Other cardholders abused their purchase card privileges or made questionable 
purchases. For example, one cardholder purchased a beer brewing kit and ingredients to 
brew beer for official parties. Another cardholder, based on questionable need, 
purchased a Samsung 63-inch plasma screen television for about $8,000 at the end of the 
fiscal year. We observed this large-screen television unused and in its original packaging 
6 months after it was purchased. In cases where appropriate, we plan to refer 
cardholders responsible for these and other purchases to DHS management for possible 
administrative action. We also found instances where items acquired with a DHS 
purchase card highlight weaknesses in DHS's inventory control and procurement 
practices that led to potentially fraudulent and abusive or questionable activity. For 
example, over 100 laptops were lost or misappropriated when shipped to New Orleans as 
part of the relief efforts. The above examples of potential fraud, improper use of the 
purchase card, and abusive or questionable activity relating to items acquired with DHS 
purchases cards are further detailed below. 
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Weaknesses in DHS's Overall Control Environment Contributed to Ineffective 
Purchase Card Program Controls 

DHS has not established an effective internal control environment to manage its 
government purchase card program. Specifically, for the last two years, DHS did not 
finalize its departmentwide purchase card policy that detailed the internal control 
policies and procedures that organizational elements must follow. As a result, 
cardholders did not consistently apply basic control procedures, which were necessary 
to provide reasonable assurance that acquisitions made with purchase cards adhered to 
governmentwide requirements. Inadequate staffing and training, and a weak 
postpayment audit function further contributed to a weak overall internal control 
environment and left DHS vulnerable to fraud, waste, and abuse. 

Unimplemented Agencywide Manual Contributes to Inconsistency and Confusion 

DHS's Chief Financial Officer (CFO) distributed the agency's most recent draft of the 
departmentwide purchase card policies and procedures in March 2004. Since then the 
draft manual has been out for agencywide comment twice. The internal control 
procedures described in that draft document were largely consistent with OMB Circular 
No. A-123, GAO's Standards for Internal Controls, and GAO's Audit Guide. According to 
the Office of the Chief Financial Officer, the draft policies were not accepted and 
implemented across DHS due to disputes with organizational elements over 
implementation of the draft manual. Further, officials within the Office of the Chief 
Financial Officer do not have a plan or timeline for resolving these disputes in order to 
finalize DHS's draft manual. Consequently, some organizational elements are following 
internal control policies that existed in their legacy environments prior to their 
absorption into DHS, while others adopted DHS's draft policies. Others are adhering to 
elements from both. We found that although some internal control policies from legacy 
agencies were consistent with GAO's Standards for Internal Controls and GAO's Audit 
Guide, others were not. For example, the Organizational Program Coordinator (OPC) for 
the Purchase Card Program at the Coast Guard stated that written authorization prior to 
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purchase is generally required. In contrast, CBP indicated that written authorization is 
not required prior to use by a CBP cardholder. 

As a result of the unimplemented DHS draft manual, organizational elements were 
confused about and did not consistently apply purchase card policies and procedures, 
which negatively affected the control environment. As an example, the OPC at the Coast 
Guard, in charge of the largest purchase card program within DHS, informed us that 
some cardholders within Coast Guard followed the draft DHS manual, while others did 
not consider the manual applicable. 

Insufficient Resources Committed to Purchase Card Program 

DHS failed to assign sufficient resources to manage its purchase card program. As a 
result, we found many instances where approving officials had oversight responsibilities 
for an excessive number of cardholders. Additionally, we found that DHS lacked 
sufficient staffing to effectively manage and oversee the purchase card program. 

GAO's Audit Guide and OMB Circular No. A- 123 emphasize the importance of 
establishing reasonable levels of responsibility for approving officials who are 
responsible for reviewing and certifying purchase card transactions. Assigning approving 
officials more cardholders than they can effectively supervise is a symptom of a weak 
control environment, as it is unreasonable to expect approving officials who have too 
many transactions to conduct a thorough and proper review of supporting 
documentation for each transaction. Basic fraud prevention concepts and our previous 
audits of purchase card programs have shown that opportunities for fraud and abuse 
arise if cardholders know that their purchases are not being properly reviewed. 

We found that DHS's draft manual contained requirements for approving officials that 
are consistent with OMB Circular A- 123 and GAO's Audit Guide. Specifically, the 
proposed DHS policy stipulates that a single approving official may not oversee more 
than 7 cardholders. However, our work showed that DHS organizational elements did 
not adhere to this guidance. As shown in table 1, as of the end of fiscal year 2005, we 
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found that 176 DHS approving officials, out of approximately 3,300 approving officials 
departmentwide, had oversight responsibilities for more than 7 cardholders. 6 At the 
Coast Guard alone, 147 approving officials supervised more than 7 cardholders, with 3 
individuals managing more than 30 cardholders. According to the OPC at the Coast 
Guard, insufficient staff to monitor and oversee the purchase card program is a primary 
cause for the large number of approving officials with excessive span of control. Having 
approving officials responsible for more than 7 cardholders is inconsistent with the DHS 
draft manual and is contrary to GAO's best practices guidance. 



Table 1: Number of Approving Officials at DHS Organizational Elements with 
Excessive Span of Control 



Number of approving officials with excessive 

span of control, stratified by number of 
cardholders managed 



Organizational element 


8-10 


11-20 


21-30 


>30 


Total 


U.S. Coast Guard 


84 


53 


7 


3 


147 


U.S. Customs and Border Protection 


7 


3 








10 


Federal Emergency Management Agency 


5 


3 








8 


U.S. Secret Service 


3 


2 





2 


7 


DHS Science and Technology 


1 











1 


Transportation Security Administration 





1 








1 


U.S. Citizenship and Immigration Service 


1 











1 


Federal Air Marshal Service 


1 











1 


Total 


102 


62 


7 


5 


176 



Source: GAO analysis of U.S. Bank data. 



Our analysis of purchase card data uncovered other fundamental breakdowns in 
controls. For example, we identified 6 cardholder accounts where the approving official 
and the cardholder were the same individual — a major conflict of interest. We also 
identified 2,468 open accounts — 19 percent of DHS's purchase cards — that as of 
December 13, 2005, had not been used since before January 2005. According to OMB and 
the U.S. General Services Administration (GSA),' purchase cards should only be issued 
to individuals who have a documented need to acquire items for the government with the 



6 On an agencywide basis, 2,150 cardholders, or over 20 percent of DHS's over 9,000 cardholders, were managed by 
approving officials whose span of control exceeded the 7:1 cardholder to approving official internal control as 
contained in the DHS draft manual. 

7 Federal agency purchase card programs operate under a government wide GSA SmartPay© master contract. 
Agency purchase card programs must comply with the terms of the contract and task orders under which the agency 
placed its order for purchase card services. 
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purchase card. It is difficult to argue that the 2,468 individuals who have not made a 
single purchase in an entire year have such a need. Consequently, those accounts should 
have been closed to minimize the risk of fraud, waste, and abuse. 

Furthermore, we found that at both the DHS level and organizational element level, there 
were inadequate resources to effectively manage the program. As stated in GAO's Audit 
Guide, it is vital for purchase card programs to be sufficiently staffed to manage the 
program. At the DHS agencywide level, the DHS Agency Program Coordinator (APC) is 
the sole person responsible for overseeing not only DHS's Purchase Card Program, one 
of the government's largest purchase card programs, but also DHS's Travel Charge Card 
Program and Fleet Charge Card Program. 8 In total, DHS spent nearly $1 billion on these 
three charge card programs during fiscal year 2005. Based on our assessment of the 
control environment and discussions with the APC, a lack of adequate resources caused 
insufficient management and oversight of the purchase card program at the DHS 
agencywide level. 

At the organizational element level, we found a similar lack of staffing resources devoted 
to the management of the purchase card program. For example, as shown in table 2, the 
number of personnel assisting the OPC at the organizational element level is not 
consistent with the risk of exposure, as measured by expenditures. In fact, the largest 
organizational element, the Coast Guard, provides no additional staff to the OPC to assist 
in managing and overseeing the purchase card program. Based on our assessment of the 
control environment and discussions with the OPC at the Coast Guard, the Coast Guard 
did not have adequate resources to both administer the purchase card program and 
provide adequate compliance control. 



The GSA offers SmartPay®, a federal government charge card program that improves travel, purchase, and fleet 
payment services for federal employees by simplifying payments and cutting administrative costs. 



Page 9 



GAO-06-957T 



Page 20 



GAO-06-1117 Purchase Cards 



Appendix I 

Testimony GAO-06-957T 



Table 2: Employees Responsible for Management of the Purchase Card Program 
at Four of the Largest Organizational Elements within DHS 







Fiscal year 2005 




Staff devoted to purchase 


total purchase card 


Organizational element 


card 


dollars (millions) 


U.S. Coast Guard 


1 (OPC) 


$227 


Federal Emergency Management Agency 


2 (1 OPC and 1 additional staff) 


32 


U.S. Immigration and Customs Enforcement 


4 (1 OPC and 3 additional staff) 


21 


U.S. Customs and Border Protection 


6 (1 OPC and 5 additional staff) 


66 



Source: DHS data. 



Evidence Lacking that Most Cardholders Received Required Training 

Evidence was not provided to show that DHS is providing the training necessary to 
obtain reasonable assurance that its cardholders understand the purchase card 
program's key controls. Adequate training is essential to ensuring that the cardholders 
and approving officials have the skills necessary to achieve organizational goals in an 
effective and efficient manner. OMB Circular' A- 1 S3 and DHS's draft manual require that 
all cardholders be trained prior to receiving a purchase card and receive annual refresher 
training. We found that for 60 of the 96 transactions in our statistical sample, the 
cardholder lacked documentation showing that they received either the required initial 
training or the refresher training. 

Monitoring and Oversight Needs Improvement 

Our review of the DHS purchase card program found that DHS had ineffective 
procedures to monitor and oversee cardholder's compliance with agencywide and 
governmentwide purchase card policies through postpayment audits. The purpose of the 
postpayment audit is to provide reasonable assurance that the purchases made by 
cardholders, and payments made to the bank, were valid and appropriate. However, our 
audit found that DHS did not conduct postpayment audits effectively. Specifically, we 
found that the organizational elements did not follow up with cardholders who failed to 
provide the required supporting documentation. We identified 10,339 transactions 
between December 2003 and February 2006 that were selected for audit, but which were 
not audited because cardholders did not submit the required supporting documentation. 
Many of the cardholders who failed to submit the required supporting documentation 
were nevertheless allowed to continue using their purchase cards. Failure to suspend 
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those cards and discipline users exposed DHS to fraud, waste, and abuse in its purchase 
card program. 

Inconsistently Implemented Control Activities Leave DHS Vulnerable to Fraud, 
Waste, and Abuse 

The results of our testing of key controls at DHS revealed significant failure rates that 
bring into question the efficacy of DHS's implementation of internal controls. Internal 
control activities associated with purchase card transactions occur at various levels 
within an agency. Activities include a wide range of diverse actions such as 
authorizations, verifications, reconciliations, certifications, and the production of 
records and documentation. However, our statistical tests of DHS purchase card 
transactions from June 13, 2005, through November 12, 2005, found that several key 
transaction-level controls were ineffective, with failure rates ranging from 8 percent to 
63 percent. In addition, the high rates of failure associated with authorization and 
independent receipt and acceptance also led us to question the effectiveness of the DHS 
reconciliation and certification process. Specifically, DHS's automated systems and 
practices associated with reconciling and certifying purchase card transactions for 
payment were not effective to provide reasonable assurance that charges appearing on 
the cardholder's bank statements were valid. We also found instances where DHS lacked 
effective controls to ensure proper follow-through of disputed transactions, leaving DHS 
at an increased risk of fraud, waste, and abuse associated with the payment of purchase 
card transactions. 

Finally, while DHS did not rely on its increased micropurchase threshold authority, DHS 
did activate certain FAR provisions to streamline the acquisition process for transactions 
made in response to the hurricane disaster in the Gulf Region. We are not questioning the 
authority on which DHS relied. However, we have identified examples where DHS did 
not exercise prudent pricing practices. 
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Statistical Tests Indicated Weak Internal Controls 

Control activities we tested included whether (1) cardholders obtained written 
authorization prior to purchases, (2) invoices supporting the transactions existed, (3) 
independent receipt and acceptance of goods and services occurred, and (4) cardholders 
screened for required or preferred vendors (designated sources). As shown in table 3, the 
failure rates for the four attributes that we tested ranged from 8 percent to 63 percent. 
We looked for documented evidence that these control activities were followed; 
therefore, these rates may be higher than actual failures rates if control activities were 
followed but not documented. 

Table 3: Results of Statistical Testing for Four Key Internal Controls (percent) 



Internal control 


Point estimate" 


95-percent confidence interval 6 


Authorization 


45 


35-55 


Sales documentation 


8 


4-16 


Independent receipt and acceptance 


63 


53-73 


Priority for designated sources 


53 


43-63 



Source: GAO and DHS OIG testing and statistical analysis of DHS purchase card transactions provided by U.S. 
Bank. 

a The numbers represent point estimates for the population based on our random sample rounded to the nearest 
percentage point. 

b The numbers represent a 2-sided confidence interval assuming a 95 percent confidence level. 



Lack of Written Authorization — In 45 percent of the sample transactions, the 
cardholders did not obtain written authorization prior to obtaining the items in question. 
Requiring the cardholder to obtain written authorization prior to using the purchase card 
is key to providing reasonable assurance that the purchase represents a legitimate 
government need. The draft manual addresses this fundamental internal control element 
by proposing to require written authorization prior to purchases. However, as indicated 
by the high rate of failure, cardholders did not consistently adhere to this internal control 
standard, thereby exposing DHS to misuse of the purchase card. For example, a 
cardholder from CBP acquired nearly $2,500 in rain jackets without written 
preauthorization. Had the cardholder been subject to DHS's requirement for written 
authorization prior to purchase, as outlined in the draft manual, this improper purchase 
may have been prevented. 
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Lack of Sales Documentation Supporting Purchases — We estimate that 8 percent of 
DHS cardholders failed to provide sales documentation, such as a receipt, for the items 
obtained with a purchase card. This is inconsistent with the draft manual, which would 
require cardholders to obtain and retain all sales documentation relevant to their 
transaction. Requiring cardholders to obtain and retain sales related documentation from 
the vendor is a basic internal control to reduce the risk of fraud, waste, and abuse. 
Without sales documentation, an approving official has no means of reasonably 
determining whether the item purchased represents a legitimate government need or is 
fraudulent, improper, or abusive. 

Lack of Independent Receipt and Acceptance — We estimate that 63 percent of DHS 
transactions did not have independent receipt and acceptance. Receipt and acceptance 
of goods and services by someone other than the cardholder provides reasonable 
assurance that the organization actually received what it purchased. This internal control 
procedure segregates the duties involved in the acquisition of goods and services and 
thereby reduces the risk of fraud, waste, and abuse. According to GAO's Audit Guide, a 
properly documented independent receipt and acceptance must contain the signature of 
the independent individual, who should also document the date of receipt. Failure to 
adhere to proper receipt and acceptance procedures exposes agencies to increased risk 
of fraud, waste, and abuse. For example, a transaction we sampled involved the purchase 
of three laptop computers by a Coast Guard cardholder. However, independent receipt 
and acceptance was not performed, and the laptops were not recorded in the property 
records. Subsequently, the laptops could not be located and were later reported as 
stolen. If proper receipt and acceptance had been performed, theft of the laptops may 
have been prevented. 

Failure to Give Priority to Designated Sources — We estimate that in 53 percent of the 
sampled transactions, the cardholder failed to document whether they gave priority to 
designated sources. In one example, a cardholder purchased 25 portable global 
positioning system (GPS) units at full retail price from Best Buy when the same units 
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could have been obtained through a GSA Advantage 11 vendor for 15 percent less. The DHS 
draft manual would require that cardholders use designated sources if the source is 
capable of providing the goods or services as needed. GSA Advantage is identified as a 
designated source in the draft manual. Generally, the goods and services provided by 
designated sources will be offered at reasonable prices. 10 In this case, the failure to 
consider designated source resulted in the cardholder paying Best Buy about $2,700 
more than if the units were acquired through GSA Advantage. Although the cardholder 
was acquiring the GPS units for an emergency situation, we found that GSA Advantage 
can often deliver goods on an expedited basis. Alternatively, the cardholder could have 
obtained a special discount from Best Buy if he had opened a government account. 



Online Reconciliation and Certification Processes Not Fully Effective 

Effective reconciliation and certification are crucial in helping to provide reasonable 
assurance that all charges appearing on the cardholder's bank statement are valid. 
However, our review of the DHS purchase card systems found that the practices used by 
the Coast Guard, FEMA, CBP, and U.S. Immigration and Customs Enforcement (ICE) 
were not fully effective. Each of these organizational elements primarily relied upon 
online reconciliation and certification capabilities inherent in their respective purchase 
card systems, but none of these systems provided sufficient evidence to determine if a 
comprehensive reconciliation and certification was actually performed. While online 
processes can provide an efficient and effective means for accomplishing such tasks 
without the burden of a paper-laden environment, reliance upon online processes 
requires effective internal controls (e.g., sufficient audit trails, implementation of sound 
business practices) to gain reasonable assurance that the processes were properly 
performed. However, none of these DHS components had fully effective systems or 
practices to provide reasonable assurance that cardholders exercised due diligence in 



g GSA Advantage, a program offered by the GSA, is a convenient one-stop shopping source to meet federal 
agencies' procurement needs by selecting and listing vendors who may offer the best value. 

l0 Using designated sources results in the agency obtaining reasonable prices or purchasing goods and services that 
meet other policy objectives, such as creating jobs and training opportunities for people who are blind or have other 
severe disabilities. 
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reconciling their statements. One attribute lacking was notations, such as the ability to 
enter check marks indicating that transactions on the cardholder's monthly statements 
were individually reviewed and reconciled. In addition, these components did not 
demonstrate that they had fully effective systems or practices that would allow them to 
track the length of time a cardholder spent performing their reconciliation and an 
approving official spent certifying statements to rule out the possibility of merely "rubber 
stamping" monthly statements. Further, we found many instances where approving 
officials did not certify their respective cardholders' statements. DHS's draft manual 
requires approving officials to certify a cardholder's bill within 14 days of the close of 
billing cycle. Based on the results of our analysis, we identified 8,630 uncertified 
statements that were pending approving official certification as of February 12, 2006. 

As previously discussed, given the insufficient resources committed to the purchase card 
program and the high rates of failure associated with the authorization and independent 
receipt and acceptance, comprehensive reconciliations and certifications are crucial in 
helping to provide reasonable assurance that all charges are valid. As a result of these 
internal control weaknesses, DHS's compliance with controls to prevent or detect 
fraudulent, improper, or abusive purchases is in question. 

Pay and Confirm Environment Increased Risk of Fraud, Waste, and Abuse 

We found instances where DHS cardholders failed to dispute unauthorized transactions. 
The dispute process is especially critical in DHS's pay and confirm environment, called 
SmartPay®. One feature of GSA's SmartPay® program is that, unlike a normal credit 
card monthly billing process, the agency pays charges daily. By agreeing to pay first and 
confirm later, agencies can reduce costs since the bank provides rebates" based on how 
quickly the charges are paid. However, the pay and confirm environment requires 
diligence on the part of cardholders to perform thorough and comprehensive 
reconciliations of their charges and to submit timely disputes of improper charges to the 



"As part of GSA's SmartPay® program, contracting banks provide rebates (refunds) to agencies based on sales 
volume (payments) and payment timeliness. 
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bank for credit. Because agencies have already paid the bank for the potential 
unauthorized charges prior to receiving the monthly billing statement, the payment will 
not be reversed unless a dispute is submitted. 

Because of weaknesses in the implementation of the dispute process in some instances, 
DHS did not identify and obtain credits for unauthorized transactions. In one instance, a 
cardholder appropriately initiated the dispute process when a vendor improperly 
charged the government $153,000 prior to completion of contracted services. However, 
the cardholder failed to perform appropriate follow-through and submit the required 
dispute documentation. Consequently, DHS made a second payment to the vendor when 
services were complete, resulting in a double payment of $153,000. FEMA was unaware 
of the double payment until we questioned the payments in May 2006. At that time, 
FEMA contacted the vendor and recovered the overpayment. In another example, 
discussed later in this testimony, a cardholder's failure to dispute $30,000 in 
unauthorized charges resulted in FEMA making payments for potentially fraudulent and 
improper charges for flat-bottom boats. In this case, the cardholder and the approving 
official failed to dispute the unauthorized charges. 

Although the pay and confirm environment can bring economic benefits (i.e., rebates) to 
federal agencies, it requires the implementation of effective controls to detect and 
correct charges that should be disputed and reversed. The high rates of failure in our 
tests of key internal controls and the examples highlighted above bring into question 
whether DHS's pay and confirm process exposes DHS to unacceptable levels of risk for 
fraud, waste, and abuse. 

DHS Used a Provision of the Federal Acquisitions Regulations to Avoid Obtaining 
Competitive Bids 

To facilitate the government's response to hurricanes Katrina and Rita, Congress 
authorized an increase to the micropurchase threshold from $2,500 to $250,000. When 
making micropurchases, authorized cardholders need not solicit for competitive bids if 
they consider the price reasonable. Executive agencies such as DHS could have 
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extended this authority to certain cardholders directly supporting hurricane-related 
rescue and relief operations. However DHS told us that they did not implement the 
increased threshold because they had the flexibility they needed to make noncompetitive 
purchases under existing procurement authority. DHS cited their justification for other 
than full and open competition under the Unusual and Compelling Urgency provisions 
of the Federal Acquisition Regulations. 11 Under these provisions, cardholders had 
discretion to select contractors noncompetitively as long as the purchase was directly 
related to Hurricane Katrina response efforts. 



Although DHS has authority to make purchases without competition, we highlight 
transactions where DHS cardholders failed to adopt prudent pricing practices and 
subsequently wasted government funds. Part of DHS's mission is to respond to 
emergency situations like Katrina and Rita and a reasonable person would expect DHS to 
be more prepared for relief and rescue operations than other agencies with routine 
functions. In this light, we question the propriety of several of the noncompetitive 
transactions that we investigated for potential fraud. In the next section we identify 
many examples of potential fraud, improper purchases, and abusive or questionable 
transactions. Some of the examples are multifaceted and touch on several issues 
including the pricing and requirements management issues discussed previously. 

Potentially Fraudulent, Improper, Abusive, or Questionable Transactions 

Our forensic audit and investigative work identified numerous transactions where DHS 
failed to prevent or detect potential fraudulent, improper, abusive, or questionable 
purchases. Many of these examples also show that the government could have obtained 
better pricing. However, our work was not designed to identify all instances of, or 
estimate the full extent of fraud, waste, and abuse. Therefore we did not determine, and 
make no representations regarding, the overall extent of fraudulent, improper, and 
abusive or questionable transactions. 

12 6. 302-2 and 41 U.S.C. § 253(c)(2), state that "[a]n executive agency may use procedures other than competitive 
procedures only when . . . the executive agency's need for the property or services is of such an unusual and 
compelling urgency that the Government would be seriously injured unless the executive agency is permitted to 
limit the number of sources from which it solicits bids or proposals." See also 48 C.F.R. § 6.302-2, Unusual and 
compelling urgency. 
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Potentially Fraudulent and Improper Activity Related to Purchase Card Acquisitions 

Our data mining work identified many instances of both potentially fraudulent and 
improper use of the purchase cards, and potentially fraudulent and improper activity 
related to items acquired with the purchase card. We considered potentially fraudulent 
purchases to be those which were unauthorized and intended for personal use. The 
transactions we determined to be improper are those intended for government use, but 
which are not for a purpose that is permitted by law, regulation, or policy. 

Potentially Fraudulent Activity — Table 4 shows five cases of potential fraud involving 
both use of a DHS purchase card and weaknesses with DHS's accountable property 13 
controls that led to potentially fraudulent misappropriation of government assets. 
Property that is unaccounted for may simply be misplaced; or it may be that the assets 
were misappropriated for a use other than that of the government. The misappropriation 
of government assets (theft) represents fraudulent activity. These five potentially 
fraudulent cases involve 154 missing items out of the 433 accountable property items 
that we tested. Because only a limited number of transactions in our statistical sample 
contained accountable or pilferable property, we did not attempt to estimate the extent 
to which DHS could not account for pilferable property. 



1 DHS's Personal Property Management Directive 565 defines accountable property as personal property with an 
initial acquisition cost at or above a specific threshold, and items designated as sensitive. These items are to be 
recorded in the organization's automated control system. DHS's Capitalization and Inventory of Personal Property 
Management Directive 1 120 establishes differing thresholds for tracking accountable property. Generally, DHS 
requires its organizational elements to track electronic communications equipment with a cost greater than or equal 
to $1,000, information technology equipment with memory at any cost, and other personal property with a cost 
greater than or equal to $5,000. 
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Table 4: Potentially Fraudulent Activity 







Organizational 






Amount of 


Case 


Items purchased 


element 


Vendor 


Additional facts 


transaction 


1 


Laptop computers 


FEMA 


CDW 


107 of 200 not located 


$300,000 


2 


Flat-bottom boats 


FEMA 


Banita 
Creek Hall 


Unauthorized use of purchase 
card by a vendor, 12 of 20 
boats not in property system 


177,000 


3 


Printers 


FEMA 


CDW 


22 of 100 not located 


84,000 


4 


GPS units 


FEMA 


Best Buy 


2 of 25 not located 


18,000 


5 


Laptop computers 


Coast Guard 


Best Buy 


3 of 3 reported as stolen 


13,000 



Source: GAO and DHS OIG investigation. 



Our testing work for the above transactions included traveling to the location of the 
accountable property to observe the item and determine if the asset existed or was in 
possession of the government. More detailed information is as follows: 

• In cases 1, 3, and 4, FEMA purchased 200 laptops, 100 printers, and 25 GPS units in 
five separate transactions totaling about $400,000. While FEMA documented 
independent receipt and acceptance for the laptops and the GPS units, it did not do 
so for the printers. Further, FEMA did not properly record and track some of the 
assets in its property records. As a result, FEMA could not locate the accountable 
property items when asked, and consequently was not able to account for 107 
laptops, 22 printers, and 2 GPS units that cost about $170,000. 

Based on the information FEMA provided for the location of the assets in question, in 
March 2006 we traveled to the FEMA field offices in New Orleans and Baton Rouge to 
observe assets acquired using a purchase card. After arriving at these locations, 
however, FEMA gave us different location information. We were instead informed 
that the laptops were shipped directly to and currently located in a conference room 
at the Royal Sonesta Hotel in the French Quarter, which was serving as the Joint 
Command Post for the various federal, state, and local authorities. We were told that 
many of the laptops and printers were being used by the New Orleans Police 
Department (NOPD) at the Joint Command Post. However, as shown in figure 1, 
when FEMA's accountable property officer took us to the conference room, it was 
vacant and the laptops and printers were missing. 
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Figure 1. Hotel Conference Room Where FEMA Laptops and Printers Were 
Supposed to Be 




Source: GAO. 



We questioned NOPD to find the location of the laptops and printers and we were 
able to account for 28 laptops and 16 printers in the possession of NOPD personnel 
and 4 laptops in possession of the Louisiana District Attorneys Office (LAD A). These 
assets were on loan to NOPD and LADA to assist them in their hurricane response 
efforts. We subsequently accounted for 61 laptops, 72 printers, and 23 GPS units at 
FEMA field offices in Baton Rouge and New Orleans. Despite substantial efforts to 
locate the property, neither FEMA, GAO, or DHS OIG was able to find all the 
accountable property at the time of our field testing. Ultimately, FEMA could not 
account for 107 laptops, 22 printers, and 2 GPS units with a total value of about 
$170,000. 
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Significantly, we found that FEMA failed to enter the laptops into their accountable 
property system until two months after delivery. In addition, when FEMA did add the 
laptops to the property system, they failed to accurately record who was in 
possession of the laptops. In February 2006, after we made inquiries regarding the 
laptops, FEMA made an effort to track down the laptops and properly record who 
was in possession of and accountable for the laptops. However, they were unable to 
do so for most of the laptops. The process for using a purchase card to obtain highly 
pilferable and expensive equipment such as laptops should include controls that 
ensure such property is accurately recorded and tracked in a property system. In this 
case, the absence of effective controls led to potential fraud and a substantial cost to 
the taxpayer. 

• For case 2, FEMA paid a vendor $208,000, or twice the retail price, to deliver 20 flat- 
bottom boats (with motors and trailers) needed for relief operations in New Orleans. 
This vendor, a broker who did not possess any boats himself, used the FEMA 
purchase card account number to pay for the boats prior to delivery to FEMA. He 
also used the card number to make two unauthorized payments for 6 of the 20 boats 
totaling about $30,000. Although the vendor billed FEMA for all 20 of the boats, the 
vendor failed to pay one retailer who provided 11 of the 20 boats. This retailer 
provided the boats to the broker believing he was dealing with a FEMA 
representative, and therefore the retailer did not require payment up-front. The 
retailer has since reported the 11 boats as stolen and not provided title to the vendor. 
Further, FEMA only has 8 of the 20 boats in its property records and could not 
provide the location for the other 12 boats. 

Many issues surround the purchase of the 20 boats, but the most significant involve 
the vendor. We estimate that the vendor walked away with over $150,000, including 
the profit he made on the 11 boats that the vendor obtained without payment. We are 
coordinating our investigation with both local law enforcement and the Federal 
Bureau of Investigation. Key control breakdowns relating to this transaction include 
the cardholder not obtaining adequate receipt and acceptance as evidenced by the 
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fact that FEMA did not receive title to at least 11 boats, and the fact that neither the 
cardholder or the approving official flagged two unauthorized charges on the monthly 
purchase card statement. 

• Case 3 involved one or more Coast Guard employees who submitted falsified records 
and provided false information pertaining to the theft of three laptop computers. Our 
investigative work found that a Coast Guard cardholder, accompanied by an 
Information Technology (IT) specialist, purchased 13 laptops from Best Buy using his 
government purchase card. The cardholder placed the laptops in an unsecured trailer, 
but did not immediately record the serial numbers so they could be entered into an 
accountable property system. According to the cardholder, 3 laptops went missing 
the next day. In an interview with our investigator and the Coast Guard Investigative 
Service, the cardholder admitted that he did not record the serial numbers 
immediately as instructed by his superior, and the property log was subsequently 
falsified to include fictitious serial numbers for the missing laptops. During separate 
interviews with the cardholder and the IT specialist, we noted inconsistencies in their 
explanations. We attempted to conduct a follow-up interview with the IT specialist, 
but after being notified to report for the scheduled interview, the IT specialist took 
actions that made himself unavailable. The Coast Guard Investigative Service is 
continuing to investigate the stolen laptops. 

Improper Transactions — We identified numerous instances where cardholders used 
their purchase cards to make improper purchases. According to the FAR, purchase cards 
may be used only for purchases that are otherwise authorized by law, regulation, or 
organizational policy. Table 5 contains some examples of improper transactions. 



Table 5. Examples of Improper Purchase Card Transactions 







Organizational 




Amount of 


Case 


Items purchased 


element 


Vendor 


transaction 


1 


Meals ready to eat (MRE's) 


CBP 


MRE Foods.com 


$465,000 


2 


Waste removal 


FEMA 


EMO Energy Solutions 


153,000 


3 


Rain jackets 


CBP 


Helly Hansen 


2,500 


4 


Men's clothing 


ICE 


Hecht's 


430 



Source: DHS data. 
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The following contains detailed information on some improper transactions shown in 
table 5: 

• Case 1 related to the improper use of convenience checks, where a CBP cardholder 
improperly issued five convenience checks totaling about $465,000 to prepay for a 2 
months' supply of meals-ready-to-eat (MRE), about $30,000 of which was for 
shipping. The MREs were sent to the Gulf Region for consumption by CBP employees 
who were deployed to assist in the response to the hurricanes. In general, DHS 
policies consider the use of convenience checks a tool of last resort, that is, to be 
used only after "maximum efforts" have been made to find alternate vendors who 
accept the government purchase card. However, we found that the CBP cardholder 
violated DHS policies related to use of convenience checks. 

In addition, the CBP employees who were sent to the Gulf Region were pulled out 
earlier than anticipated and almost half of the MREs purchased were delivered to a 
CBP training facility in El Paso, Texas. Because the cardholder prepaid for the MREs, 
the cardholder precluded the option of buying in increments as the fluid 
circumstances might have dictated. Because the demand did not materialize, 
thousands of MREs are sitting in a warehouse in El Paso, Texas. 

The cardholder in this instance relied on the Unusual and Compelling Urgency 
provisions of the Federal Acquisition Regulations to expedite the purchase and meet 
an apparent need. While we are not questioning the cardholder's reliance on these 
provisions, we identified actions taken by the cardholder that unnecessarily 
increased the cost to the taxpayer: 

o Instead of contracting with the Defense Logistics Agency 14 (DLA) to deliver 
MREs on an as-needed basis, the cardholder acquired about 62,000 MREs from 
a vendor on the internet. However, DLA informed us that it had a large supply 

l4 DLA provides worldwide logistics support for the missions of the military departments and the Unified Combatant 
Commands under conditions of peace and war. It also provides logistics support to other DOD components and 
certain federal agencies such as DHS. 
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of MREs when Hurricane Katrina hit the Gulf Region and would have been 
able to meet CBP's demand for MREs and provide free shipping. Further, we 
found that a GSA Advantage vendor was selling similar MRE's at a 
substantially lower price than what the cardholder paid. The vendor selected 
by the cardholder was not a GSA Advantage vendor and the cardholder 
acknowledged that she did not contact this GSA Advantage vendor. Had the 
cardholder contacted the GSA Advantage vendor, she may have saved 
taxpayers over $100,000. 

o The website of the vendor selected by the cardholder clearly shows that it 
accepts credit cards. However, according to the cardholder, the vendor did not 
want to incur a credit card processing fee on the large order. The cardholder 
therefore paid the vendor using convenience checks, which cost the 
government a 1.75 percent processing fee. Therefore, due to the cardholder's 
improper use of convenience checks, DHS paid $8,000 in processing fees 
unnecessarily. 

• In CBP cardholder improperly used his purchase card to acquire 37 black 

rain jackets from Helly Hansen for nearly $2,500 and obtained a government 
discount to the personal benefit of CBP employees. The purchase violated CBP's 
policy against using a purchase card to acquire clothing. The cardholder claimed 
the rain jackets were personal protective equipment (PPE) for which there is an 
exception. The cardholder explained that the black rain jackets are given to safety 
officials on the firing range and allow these officials to be readily identified. 
However, these officials are issued red shirts for safety and identification 
purposes and when it rains, the red shirts are covered by the rain jackets. Other 
individuals who are not safety officials also wear black rain jackets, making these 
other individuals indistinguishable from safety officials. Therefore, the rain 
jackets do not serve a safety purpose and are not PPE. The cardholder also 
admitted that when the rain is heavy, the firing range is normally shut down. 
Furthermore, the rain jackets were not kept on the firing range but were given to 
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range officials to keep, without any record of who was receiving the rain jackets. 
While safety of CBP employees should be a primary concern, the facts in this case 
indicate that cardholder obtained a government discount from the vendor to 
provide personal clothing to CBP employees and for which no safety related 
purpose was served. 

Abusive and Questionable Transactions 

We identified numerous examples of abusive and questionable items acquired with DHS 
purchase cards during our testing. We defined abusive transactions as those that were 
authorized, but the items purchased were at an excessive cost (unreasonable pricing) or 
were not needed by the government, or both. As an organization whose mandate is to 
deal with security and emergency needs, DHS and its employees should adopt prudent 
purchasing practices by implementing existing agreements with vendors to allow 
favorable pricing even in times of disaster. Questionable transactions are defined as 
transactions that appear to be improper or abusive but for which there is insufficient 
documentation on which to conclude. 10 

Obtaining reasonable pricing for goods or services includes not only avoiding excessive 
pricing, but also includes taking reasonable steps to obtain appropriate discounts. 
However, vendors often will not provide discounts unless the government cardholder 
asks if a discount is available. We found instances where it was likely a vendor discount 
could have been obtained but was not. However, we noted several occasions where 
cardholders obtained a point-of-sale discount. For example, an ICE cardholder obtained 
60 sleeping bags and cots from Cabela's. The sleeping bags and cots were acquired to 
meet the needs of those affected by the hurricanes. The cardholder was able to obtain a 
10 percent point-of-sale discount from the manager. By asking for the discount, the 
cardholder was able to save the taxpayer over $750. In another example, FEMA 
purchased over $600,000 in medical equipment and supplies from Medtronic Physio- 

l5 GAO's Guide for Evaluating and Testing Controls Over Sensitive Payments (GAO/AFMD-8.1.2, May 1993) 
states: "Abuse is distinct from illegal acts (non-compliance). When abuse occurs, no law or regulation is violated. 
Rather, abuse occurs when the conduct of a government organization, program, activity, or function falls short of 
societal expectations of prudent behavior." 
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Control in three separate transactions in order to supply special medical response teams 
after the hurricanes. FEMA obtained almost $18,000 in point-of-sale discounts from this 
vendor. 

In order to obtain the best pricing, it is often beneficial to make arrangements with 
vendors in advance of potential spikes in demand for goods or services. We noted 
numerous instances where we believe better pricing could have been obtained had 
various DHS organizational elements made arrangements with vendors in advance of the 
devastating hurricanes along the Gulf Region. If DHS does not anticipate its needs and 
get prearranged pricing from quality vendors, then it must often scramble to acquire the 
necessary goods and services during a crisis. Frequently, the emphasis shifts from 
efficiency to expediency when acquiring goods and services during a crisis, resulting in 
additional and unnecessary costs to the government. Table 6 lists some examples of 
abusive and questionable purchases that we identified at DHS. 



Table 6: Abusive and Questionable Transactions 







Organizational 




Nature of 




Transaction 


Item purchased 


element 


Vendor 


transaction 


Amount 


1 


Shower units 


CBP 


MD Descant 


Abusive 


$71,000 


2 


Dog booties 


FEMA 


Backcountiy Gear Limited 


Abusive 


$68,000 


3 


GPS units 


FEMA 


Best Buy 


Abusive 


$18,000 


4 


63" Plasma screen 
television 


FEMA 


Jan-Tronics 


Abusive 


$8,000 


5 


iPod Nanos and Shuffles 


USSS 


Apple 


Questionable 


$7,000 


6 


Training seminar 


CBP 


Sea Palms Golf and Tennis Resort 


Abusive 


$2,000 


7 


Leadership conference 


CIS 


Hyatt Golf Resort. Spa & Marina 


Abusive 


$2,000 


8 


Beer brewing kit 


Coast Guard 


Beer and Wine Hobby 


Abusive 


$230 



Source: GAO and DHS OIG investigations of DHS data. 



The following provides further details on a number of transactions listed above: 

• The first case involved a CBP cardholder who paid for three 6-person portable 

shower units when less expensive units could have been rented. In this instance, CBP 
represented to us that they did not have time to obtain competing bids because of the 
need to prepare immediate shower units for CBP personnel in the Gulf Region 
responding to hurricanes. However, because CBP did not specify the need for hot 
water and sinks, the portable shower units did not come with this capability. In 
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contrast, a vendor in GSA Advantage could have rented two prefabricated 16-person 
mobile shower units with hot water capabilities and had them delivered in less time 
than it took the original vendor to deliver. The cost from the GSA Advantage vendor 
would have been approximately $45,000, or 36 percent less than the nearly $71,000 
CBP paid. 

• In case 2, a FEMA cardholder unnecessarily purchased over 2,000 sets of canine 
booties at a cost exceeding $68,000. Canine booties are used to protect the dog's 
paws in a debris laden environment. According to FEMA, after the terrorist attacks of 
9-11 many donated dog booties were placed in storage facilities and were mistakenly 
placed on emergency provisioning lists. When the hurricanes struck the Gulf Region, 
FEMA acquired items on the provisioning lists including thousands of additional dog 
booties unnecessarily. However, we were informed by FEMA that since most of the 
search and rescue dogs in the Gulf Region were not accustomed to wearing booties, 
the canine booties continue to sit unused in FEMA storage facilities. The error of 
placing the booties on the emergency provisioning list resulted in a $68,000 
unnecessary expenditure. 

• In case 4, a FEMA cardholder abused a purchase card to acquire a Samsung 63 inch 
plasma screen television on September 16, 2005 for almost $8,000, lacking a 
government need. The plasma screen, which was not timely recorded in an 
accountable property system, was still unused and in its original box six months after 
its purchase. The fact that it was unused after such an extended period of time casts 
significant doubt as to whether there was a legitimate government need for acquiring 
the 63 inch plasma screen in the first place. In addition, as the cost of high-end 
electronic equipment can fall dramatically in a short period of time, we found that the 
same 63 inch plasma screen television could have been obtained for $1,200 less at the 
time we observed it in the box at FEMA. Considering the plasma screen was bought 
at the end of the fiscal year and that it was unused 6 months after the purchase, a 
concern arises regarding whether the purchase was made to use up remaining funds 
at the end of the fiscal year. 
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• In case 5, the U.S. Secret Service (USSS) spent over $7,000 to acquire 12 Apple iPod 
Nanos and 42 iPod Shuffles. This purchase is questionable because iPods are 
generally used to store and play music — not a legitimate government need. In 
addition the USSS did not enter the iPod shuffles into its accountable property 
system. After we questioned the validity of the purchase, USSS provided a 
memorandum justifying the purchase on the basis that the iPods were used for 
training and data storage. However, we found that other memory devices existed that 
were not primarily designed to play music but would have satisfied the need for data 
storage. USSS did not provide evidence to support its claim that the iPods were used 
in training. Further, USSS represented to us that they did not track the iPod shuffles 
because the iPods cost less than the $300 threshold required for accountable 
property. This is inconsistent with established DHS policy that requires all memory 
devices be tracked in a property system. Without appropriate substantiation, we 
could not obtain assurance that the iPods were used for legitimate government needs. 

• Case 6 involved the abusive use of government funds to hold a CBP training seminar 
at the Sea Palms Resort at Saint Simons Island in Georgia. We identified a purchase 
card transaction related to this event for about $2,000 and performed additional audit 
work to determine the basis for selecting the resort. We found that the golf and tennis 
resort was used to train 32 newly hired attorneys when the nearby Federal Law 
Enforcement Training Center (FLETC) in Glynco, Georgia, could have been used with 
a savings of approximately $10,000. According to the CBP officials we interviewed, 
CBP had determined that the FLETC facility could not accommodate their training. 
However, CBP could not produce any documentation such as a request form 
indicating that CBP had contacted FLETC for determining availability. Further, a 
FLETC official in charge of scheduling informed us that FLETC did not receive a 
request from CBP and that had CBP given FLETC sufficient notice, it was more than 
likely that FLETC would have been able to accommodate CBP. While training is a 
necessary investment in human capital, cardholders and government officials need to 
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be careful stewards of taxpayer's funds. By not contacting FLETC and instead using 
the resort for training, CBP failed to act prudently with taxpayer dollars. 

• In case 7, the U.S. Citizenship and Immigration Services (CIS) held its annual 
leadership conference at the Hyatt Regency Chesapeake Bay Golf Resort, Spa and 
Marina in Cambridge, MD, which cost the government about $40,000 in additional 
travel expenses. We initially selected this transaction because a CIS cardholder had 
paid the resort about $2,300 for materials used in a team building exercise. 
Irrespective of the merits of the team building exercise expenses, holding the annual 
leadership conference about 90 miles outside Washington, D.C. resulted in roughly 50 
Washington, D.C. based staff incurring travel expenses for lodging, meals, and other 
expenses. About 110 CIS employees attended the July 2005 conference. According to 
a March 25, 2005, CIS memorandum documenting the CIS conference planning 
efforts, CIS officials only contacted resorts outside the Washington, D.C. normal 
commuting area. If CIS had held the annual conference within the Washington, D.C. 
commuting area, the 50 of the employees would not have incurred travel expenses 
and the savings to the government would have been about $40,000. 

• Case 8 involved a Coast Guard cardholder who abused his purchase card to obtain 
beer brewing equipment and ingredients, and wasted government resources by 
brewing alcohol while on duty. The cardholder, whose duties involved planning, 
procuring, and organizing social functions for the Coast Guard Academy, purchased a 
beer brewing kit for about $230 and additional ingredients. According to the Coast 
Guard, the beer kit provided the Academy with both a cost savings and a quality 
product for official parties attended by cadets, dignitaries, and other guests of the 
Superintendent. The Coast Guard also explained that the Coast Guard beer, with the 
custom Coast Guard themed labels, functioned as an "ice-breaker" for discussion at 
these official parties. 

Our subsequent work indicated that the Academy achieved no cost savings by 
brewing their own beer. From early August 2005 through March 2006, the Academy 
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used an additional $800 on beer brewing ingredients 11 ' to brew 532 bottles of beer, or 
12 batches. The Coast Guard estimated that it took two hours to brew, bottle, and 
label each batch of Coast Guard beer. Given a conservative approximate hourly labor 
rate of $15, it would cost over $13 for a six-pack of Coast Guard beer — considering 
the variable costs alone (ingredients and labor). The Coast Guard provided GAO with 
a detailed 5-year analysis showing a cost savings but the analysis failed to account for 
any labor costs. Absent the purported cost savings and the dubious need for the 
government to brew its own alcohol, the purchase of the kit and the beer brewing 
activity itself fall short of prudent use of taxpayer dollars and therefore exemplify 
purchase card abuse. 



Concluding Observations 



The purchase card has proven to be a valuable tool that provides the government 
flexibility in making purchases and saves money on transaction processing. However, 
putting purchasing decisions in the hands of about 9,000 DHS employees with ineffective 
management oversight and control has allowed potentially fraudulent, improper, and 
abusive or questionable usage of these purchase cards to go undetected. Some of the 
examples highlighted in this testimony related to Hurricanes Katrina and Rita show that 
the government is particularly vulnerable when purchase cards are used during times of 
disaster. Taking immediate action to improve the processes and internal controls over its 
purchase card program will help DHS maximize the value and benefit of the purchase 
card and provide reasonable assurance that fraud, waste, and abuse are minimized. 



'''According to Coast Guard finance personnel, funds from the Coast Guard Foundation, Inc. were used to purchase 
the beer brewing ingredients. The Foundation is a public nonprofit organization that provides annual funding to 
support the men and women of the U.S. Coast Guard and Coast Guard Academy. The Foundation's fundraising 
efforts address needs not met through traditional governmental and military funding sources. The Foundation 
supports such activities as a holiday calling-card program, capital improvements, and education grants. Although the 
ingredients were not purchased with appropriated funds, the resources provided by the Foundation could have been 
spent for other purposes, for example educational grants, had they not been used to brew beer. 
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Madam Chairman and Members of the Committee, this concludes our statement. We 
would be pleased to answer any questions that you or other members of the committee 
may have at this time. 

Contacts and Acknowledgments 

For further information about this testimony, please contact Gregory D. Kutz at (202) 
512-7455 or kutzg@gao.gov at GAO or Matt A. Jadacki at (202) 254-5477 or 
matt.iadacki@dhs.gov at DHS OIG. GAO individuals making key contributions to this 
testimony included James Ashley, Kord Basnight, James Berry, Beverly Burke, Jennifer 
Costello, Danielle Free, Christine Hodakievic, Ryan Holden, Aaron Holling, John Kelly, 
Tram Le, John Ledford, Barbara Lewis, Jenny Li, John Ryan, Robert Sharpe, Bethany 
Smith, Tuyet-Quan Thai, Patrick Tobo, and Michael Zola. DHS OIG individuals making 
key contributions to this testimony included Modupe Akinsika, Andre Marseille, and 
Frank Parrott. 

Contact points for our Offices of Congressional Relations and Public Affairs may be 
found on the last page of this testimony. 
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VHA Purchase Cards: Internal Controls Over the Purchase Card Program Need 
Improvement. GAO-04-737. Washington, D.C.: June 7, 2004. 

Purchase Cards: Increased Management Oversight and Control Could Save Hundreds 
of Millions of Dollars. GAO-04-717T. Washington, D.C.: April 28, 2004. 

Forest Service Purchase Cards: Internal Control Weaknesses Resulted in Instances of 
Improper, Wasteful, and Questionable Purchases. GAO-03-786. Washington, 
D.C.: August 11, 2003. 

HUD Purchase Cards: Poor Internal Controls Resulted in Improper and Questionable 
Purchases. GAO-03-489 . Washington, D.C.: April 11, 2003. 

Purchase Cards: Steps Taken to Improve DOD Program Management, but Actions 
Needed to Address Misuse. GAO-04-156 . Washington, D.C.: December 2, 2003. 

FAA Purchase Cards: Weak Controls Resulted in Instances of Improper and Wasteful 
Purchases and Missing Assets. GAO-03-405 . Washington, D.C.: March 21, 2003. 

Purchase Cards: Control Weaknesses Leave the Air Force Vulnerable to Fraud, Waste, 
and Abuse. GAO-03-292 . Washington, D.C.: December 20, 2002. 

Purchase Cards: Navy is Vulnerable to Fraud and Abuse but Is Taking Action to 
Resolve Control Weaknesses. GAO-02-1041 . Washington, D.C.: September 27, 2002. 

Government Purchase Cards: Control Weaknesses Expose Agencies to Fraud and 
Abuse. GAO-02-676T . Washington, D.C.: May 1, 2002. 

Purchase Cards: Control Weaknesses Leave Army Vulnerable to Fraud, Waste, and 
Abuse. GAO-02-732 . Washington, D.C.: June 27, 2002. 

Purchase Cards: Control Weaknesses Leave Two Navy Units Vulnerable to Fraud and 
Abuse. GAO-02-32 . Washington, D.C.: November 30, 2001. 
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Appendix II: Background 

The Department of Homeland Security's (DHS) purchase card program is part of the 
General Services Administration's (GSA) Smart Pay® program, which was established to 
streamline federal agency acquisition processes for eligible purchases by providing a 
low-cost, efficient vehicle for obtaining goods and services directly from vendors. Under 
the GSA blanket contract, DHS has contracted with U.S. Bank for its purchase card 
services. 

To assist DHS organizational elements in carrying out their various missions, such as 
that of the U.S. Coast Guard (Coast Guard), 1 ' U.S. Customs and Border Protection 
(CBP), 1S Transportation Security Administration (TSA),"' and the Federal Emergency 
Management Agency (FEMA), 20 DHS reported that it used purchase cards for more than 
1.1 million transactions valued at more than $420 million in fiscal year 2005. According to 
DHS data, the purchase card activity for the Coast Guard, CBP, TSA, and FEMA 
accounted for $364 million or about 86 percent of the more than $420 million in fiscal 
year 2005 DHS purchase card payments. Table 1 identifies the number and dollar 
amount of purchase card transactions during fiscal year 2005 for these and other DHS 
components. 



The Coast Guard's mission is to protect the public, the environment, and U.S. economic interest in the nation's 
ports and waterways, along the coast, on international waters, or in any maritime region as required to support 
national security. 

I8 CBP is responsible for protecting U.S. borders in order to prevent terrorists and terrorists' weapons from entering 
the U.S. while facilitating the flow of legitimate trade and travel. 

l9 TSA's mission is to protect the nation's transportation systems to ensure freedom of movement for people and 
commerce. 

20 FEMA is responsible for preparing the nation for hazards, managing federal responses and recovery efforts 
following any national incidents or disasters, and administering the National Flood Insurance Program. 
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Table 7: Number and Amount of Fiscal Year 2005 Purchase Card Transactions 





Number of 


Amount of 


Percentage of 




transactions 


transactions 


DHS purchase 


DHS Component 


(in thousands) 


(in millions) 


card payments 


Coast Guard 


568 


$227 


54% 


CBP 


295 


66 


16 


TSA 


74 


38 


9 


FEMA 


31 


32 


8 


Other DHS components 


178 


60 


13 


Total 


1,146 


$423 


100% 



Source: GAO analysis of U.S. Coast Guard Finance Center's reports. 
Management of the DHS Purchase Card Program 

DHS's Purchase Card Program Management Office, which is within the office of the 
Under Secretary for Management — Chief Financial Officer (CFO), is responsible for the 
overall management of the DHS purchase card program. In carrying out its management 
responsibilities, the Purchase Card Program Management Office has a directive for use 
by all DHS components on the Government Purchase Card Program. In addition, the 
Office of the Chief Financial Officer developed a draft manual, which has been in draft 
since March 8, 2004. This draft manual describes the various roles and responsibilities of 
key program management functions and the overall business process for carrying out the 
purchase card program. Regarding key management functions, the Agency Program 
Coordinator has responsibility for managing the overall program and working through 
the CFO and Chief Procurement Officer on purchase card issues; developing, 
implementing, and updating the program policies, procedures, and guidelines; and 
ensuring the implementation of and compliance with adequate internal controls in the 
management of the program, as well as serve as the communication liaison between DHS 
and the U.S. Bank. Further, within each DHS component, an Organizational Program 
Coordinator(s) is designated to oversee the purchase card program within that 
component (e.g., Coast Guard). Their responsibilities include controlling issuance, 
revocation, and the closing of purchase cards; providing, monitoring, and maintaining 
training prior to issuance of the purchase card and annual refresher training for all 
cardholders and approving officials; and managing and conducting oversight of the 
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program (includes span of control and ongoing and annual reviews to ensure compliance 
with the program requirements). Figure 3 illustrates DHS's business process for carrying 
out the purchase card program. 



Figure 3: DHS Purchase Card Program Flowchart 



Cardholder receives 
written authorization from 
approving official 



Purchase cardholder 
orders/charges goods 
and services 



Independent 

documentation that items 
have been received and 
accepted 
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recorded in accountable 
property records 



U.S. Bank reverses 
disputed charges and 
credits monthly statement 
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approving official logs 
disputed charges and 
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Approving official reviews 
cardholder support 
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not received and follows 
up to (1) confirm receipt 
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Finance Center 
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Bank on a daily basis 



y. GAO analysis of the business process tor the DHS Purchase Card program. 
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System (CAS) for USCG, 
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Coast Guard Is a Steward for DHS's Purchase Card Program 

Since February 2004, the U.S. Coast Guard Finance Center (Finance Center) has been 
operating under a Memorandum of Understanding with DHS to be the servicing agent 
providing centralized invoicing and payment of all DHS purchase card activity. The 
Finance Center has developed and implemented a system that supports the receipt of 
daily invoices from U.S. Bank for all DHS components, supports the payment of those 
invoices within one business day of receipt, and provides transmission of an electronic 
file containing transaction data to each component's accounting system. The intent of 
the daily payment is to maximize the performance rebates earned by the purchase card 
program. 

On a daily basis, U.S. Bank's Customer Automation and Reporting Environment 
generates an invoice file containing transaction level data for all DHS purchase card 
activity posted on the previous day and submits the file to the Finance Center, where the 
file is loaded into the Finance Center's Consolidated Billing System. Among other things, 
this system is used to process all purchase card transactions and provide data to 
participating DHS components. Cardholders are responsible for identifying any 
discrepancies on their billing statements and contacting the merchant to resolve any 
disputed transactions. If the cardholder is unable to resolve the dispute with the 
merchant, he or she has up to 60 days from the statement date to file a dispute form with 
U.S. Bank and request a credit. Approving officials are responsible for (1) receiving and 
reviewing their assigned cardholders' monthly statement to ensure all charges were 
allowable and conducted within acquisition guidelines, (2) determining that the goods or 
services were received, and documentation is complete, and (3) verifying that the 
cardholder follows through in resolving any disputed transactions with the merchant and 
U.S. Bank. An approving official's certification of the monthly billing statement cannot 
occur until the cardholder, or in some cases, the approving official, performs and 
completes a reconciliation of all charges on the statement. 
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Appendix III: Scope and Methodology 

To assess whether DHS's internal control policies and procedures are adequately 
designed to provide reasonable assurance that fraud, waste, and abuse are minimized 
and are operating effectively to prevent or detect potentially fraudulent, abusive, and 
improper purchase card use, we reviewed and tested key purchase card controls over 
purchase card use by DHS's major organizational elements. 21 Our review of purchase 
card controls covered: 

• DHS's and its organizational elements' overall management control environment, 
including (1) management's role in establishing needed controls, (2) the numbers of 
cardholders, cardholder accounts, approving/billing officials, and program 
coordinators, (3) training provided for cardholders, (4) monitoring and audit of 
purchase card activity, and (5) effectiveness of purchase card infrastructure; 

• attribute tests on a statistical sample of key controls over purchase card 
transactions made during the period from June 13, 2005 through November 12, 
2005, including (1) proper written preauthorization of purchases, (2) maintenance 
of sales documentation, (3) documented performance of independent confirmation 
that items or services paid for with the purchase card were received, and (4) 
documentation that cardholders gave priority to designated sources; and 

• data mining of the population of transactions made during the above mentioned test 
period to identify potentially fraudulent, improper, and abusive or questionable 
purchase card transactions. 



2l Major organizational elements include the U.S. Secret Service, U.S. Coast Guard, Transportation Security 
Administration, U.S. Customs and Border Protection, U.S. Citizenship and Immigration Services, U.S. Immigration 
and Customs Enforcement, Federal Emergency Management Agency, Federal Law Enforcement Training Center, 
and other headquarters-level entities. 
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Departmental and Organizational Element Control Environment 

To assess the overall management control environment for DHS's purchase card 
program, we obtained an understanding of the processes utilized by DHS and its major 
organizational elements by interviewing officials involved in overseeing and managing 
the various purchase card activities, analyzing each entity's control procedures and 
processes, and performing walk-throughs of the detailed processes utilized at the major 
organizational elements to request, approve/authorize, make, document, and 
verify/certify transactions using purchase cards. We also analyzed the database of active 
cardholders to assess the ratios of approving/billing officials to assigned cardholders and 
cardholder accounts and assessed cardholder training. For these tests, we utilized the 
active member cardholder database provided by U.S. Bank covering the period from 
June 2005 through December 2005. We also visited and interviewed officials of the Coast 
Guard's Finance Center, Chesapeake, Virginia, DHS's purchase card paying agent, to 
discuss the payment and management oversight processes utilized to ensure the timely 
processing of payments and the reasonableness and appropriateness of transactions. 



Statistical Sample of Internal Control Procedures 

We obtained and reviewed the U.S. Bank-provided database of purchase card 
transactions covering the period from June 13, 2005, through November 12, 2005, and 
analyzed a random probability sample of these transactions to assess compliance with 
key internal controls. The sample design was a simple random probability sample of 96 
transactions. The sample size was calculated to achieve a precision of any estimated 
internal control error rate for the category (except accountable property) to be +/- 10 
percentage points or less. With this probability sample, each transaction in the 
population had a known, nonzero probability of being selected. Each selected 
transaction was subsequently weighted in the analysis to account statistically for all the 
transactions in the population, including those not selected. 

Because we selected a sample of transactions, our results are estimates of a population 
of transactions and thus are subject to sample errors that are associated with samples of 
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this size and type. Our confidence in the precision of the results from this sample is 
expressed in 95-percent confidence intervals. The 95-percent confidence intervals are 
expected to include the actual results in 95 percent of the samples of this type. We 
calculated confidence intervals for this sample based on methods that are appropriate 
for a simple random probability sample. 

To test compliance with internal controls, we applied procedures in GAO's Audit Guide: 
Auditing and Investigating the Internal Control of Government Purchase Card 
Programs (GAO-04-87G, Washington, D.C.: November 2003) and internal control 
standards included in the draft manual dated March 8, 2004. We utilized DHS's draft 
manual because we found that DHS had not issued an official standardized set of 
purchase card policies and procedures since the department was established by the 
Homeland Security Act in November 2002. Further, our review of the draft procedures 
showed that the procedures contained a reasonable set of standards that were generally 
consistent with good purchase card operating policies and procedures utilized by other 
governmental entities we had audited and covered in GAO's Audit Guide. We also 
reviewed (1) OMB Circular No. A-123, (2) Treasury Financial Manual Vol. 1 Part 4-4500 
"Government Purchase Cards," (3) FAR, (4) organizational policies, including draft 
organizational policies, and (5) GAO's Standards for Internal Controls. 

Data Mining 

In addition to selecting statistically projectable samples of transactions to test specific 
internal controls, we also made nonrepresentative selections of transactions from these 
entities. We conducted separate analysis of transactions that appeared on the surface to 
be potentially fraudulent, improper, and abusive or questionable. 

Our data mining for transactions was limited in scope. For this review, we scanned the 
population of transactions for vendor names and merchant codes that are likely to sell 
goods or services that are personal in nature, listed on DHS's restricted/prohibited lists, 
or are otherwise questionable. Our expectation was that transactions with certain 
vendors had a more likely chance of being fraudulent, improper, and abusive or 
questionable. We reviewed and made inquiries about 200 transactions with vendors that 
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sold such items as sporting goods, sporting event tickets, groceries, clothing, jewelry, 
alcohol, entertainment, or were third-party payers, such as PayPal. Our inquiries also 
identified some purchases that turned out to be legitimate in terms of need but could 
have been obtained from vendors at significant price savings. We found other purchases 
were made during conditions of exigency that under normal operating conditions would 
not or should not have been made. While we identified, and performed limited inquiries 
about, some potentially fraudulent, improper, and abusive or questionable transactions, 
our work was not designed to identify, and we cannot determine, the extent of 
fraudulent, improper, and abusive or questionable transactions. 

We briefed DHS on the details of our work, including our scope, and methodology and 
our findings. We conducted our audit work from October 2005 through June 2006 in 
accordance with U.S. generally accepted government auditing standards, and we 
performed our investigative work in accordance with standards prescribed by the 
President's Council on Integrity and Efficiency. 

(192211) 
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This is a work of the U.S. government and is not subject to copyright protection in the 
United States. It may be reproduced and distributed in its entirety without further 
permission from GAO. However, because this work may contain copyrighted images or 
other material, permission from the copyright holder may be necessary if you wish to 
reproduce this material separately. 
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U.S. Department of Homeland Security 

Washington, DC 20528 




Homeland 
Security 



September 15, 2006 



Mr. Gregory Kutz 
Managing Director 

Forensic Audits and Special Investigations 
U.S. Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Dear Mr. Kutz: 

Thank you for the opportunity to review and comment on the Government Accountability 
Office's (GAO's) draft report entitled, PURCHASE CARDS: Control Weaknesses Leave 
DHS Highly Vulnerable to Fraudulent, Improper and Abusive Activity (GAO-06-743). 

The Department of Homeland Security (DHS) appreciates the effort you undertook to 
review our purchase card program. We concur with your recommendations and have 
incorporated the relevant changes into our Purchase Card Manual. 

Below, in more detail, is a summary of your recommendations and the actions that we 
have already taken or plan to take in the near future. 

Recommendation 1: Implement changes to DHS's draft Purchase Card Manual to 
include policies and procedures addressing the four areas detailed below. After 
implementing the changes, the Purchase Card Manual should be finalized agencywide. 

• Training: Establish policies and procedures that document that all cardholders 
have completed the appropriate training. The documentation should include the 
date of the training, a description of the training, and the name of the recipient of 
the training. 

• Independent Receipt and Acceptance: Develop policies and procedures for the 
performance and documentation of independent receipt and acceptance attesting 
to the receipt of goods or the complete rendering of services. This documentation 
would be maintained along with other required documentation supporting each 
transaction. 

• Accountable Property: Develop policies and procedures to provide reasonable 
assurance that highly pilferable assets such as laptop computers, cell phones, 
personal digital assistants, memory storage devices, and other pilferable property 
acquired with a purchase card are entered into an accountable property system 
immediately after being received. Cardholders should be required to contact 
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2 

accountable property officers (or others acting in a similar capacity) before 
acquiring accountable property, or within a reasonable time thereafter, so that the 
property is properly bar coded and tracked in the property system. This should be 
completed prior to placement of the asset in service. The property system should 
include accurate information on the location of the asset, the individual 
responsible for the asset, the manufacturer's serial number, as well as the 
agency's unique identification code for the asset (e.g. a bar code). 
• Disciplinary or Administrative Actions: The agency should develop a range of 
potential disciplinary and administrative actions that may occur as a result of a 
cardholder or others failing to comply with the policies and procedures in the 
Purchase Card Manual. 

Response: 

With respect to training, the following language appears in the Department's 
Purchase Card Manual that was issued 9/1 5/06: 

Section 2.1.A.2 "All DHS CHs and all AOs shall successfully complete the GSA on- 
line purchase card training program to be supplemented by DHS-specific training 
before being issued a purchase card. All CHs and AOs shall also complete annual 
refresher training in order to continue to use purchase cards assigned." 
Section 2.I.A.3. "In addition to training requirements above, additional training is 
required before CHs and AOs may receive purchase card authority above the micro- 
purchase threshold. This training will include directions for CHs with delegated 
authority to use the purchase card as a payment mechanism against established 
contracts." 

Section 3.6. B. "Single purchase limits may not be permanently increased to exceed 
$2,500 unless the CH and his/her AO have completed the DHS simplified acquisition 
training requirement as stipulated in DHS Management Directive 0740.2 and 
specialized authority has been given by the Chief Procurement Officer or subordinate 
procurement authority." 

Further language was added to Section 2.I.A.4. that: "Certificates of training will be 
retained by the OPC for 6 years, 3 months in accordance with the National Archives 
and Records Administration records retention requirements. The certificates will 
include the name of the recipient, the date(s) of training and a description (title) of the 
training." 

With respect to independent receipt and acceptance: 

Section 3.8.C.I. has been added to detail requirements for purchase card receipt and 
acceptance: 

"Receipt occurs when goods that have been ordered are delivered. Receipt is evidenced 
by an independent third party (neither the cardholder, nor the authorizing official) signing 
or initialing a receiving report form, commercial shipping document, or packing list to 
indicate that the items listed (and only those listed) are present in the delivery. A copy of 
the receipt document is maintained for use in the acceptance process. Acceptance is an 
official acknowledgment by an identifiable individual that supplies delivered or services 
performed conform to what was ordered or contracted for. Acceptance may be 
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performed at time of delivery or performance or within five business days of receipt. The 
organization(s) responsible for ordering the goods and services should be the party(s) 
responsible for accepting them. Acceptance reports shall be forwarded to the ordering 
cardholder's office by the fifth working day after acceptance and should be retained as 
documentation based on records retention criteria. The following information is required 
on or with a receiving report or delivery ticket: 

Vendor name 

Contract number or other delivery authorization 

Item description, unit of measure, and quantity received 

Dates of receipt and acceptance 

Printed name, title, telephone number, mailing address, and signature (or 
electronic alternative) of the accepting or approving official. 

Cardholders will not certify transactions on their monthly statement unless they have an 
email or written acknowledgment of receipt and acceptance. OPCs may grant waivers in 
circumstances that do not allow for segregation of duties. However, but there must be 
adequate compensating controls, such as periodic third party reviews of waived 
transactions to provide adequate assurance that there is no fraud, waste or abuse. Waivers 
and compensating controls must be thoroughly documented and retained for potential 
future audits." 

With respect to accountable property: 

Section 1.5.1.10. Cardholders shall: "Notify a local property officer before or within a 
reasonable time after acquiring accountable, sensitive and/or hazardous personal property 
so that the property may be recorded in the proper system of record. This must be 
completed prior to placing the asset in service." 
Section 3.8.C.2 

"The cardholder must seek out a procurement official to provide input, guidance, and 
direction to support purchase card and contract actions for personal and accountable 
property, as required in accordance with the Federal Acquisition Regulation and internal 
DHS asset management and inventory standards. See MD 0565, Personal Property 
Management for explanation of categories of personal property; to include accountable, 
sensitive and hazardous personal property. (Note: certain property that can easily be 
stolen or "pilfered" is addressed in MD 0565.) The cardholder should consult this 
procurement official about the propriety of any acquisition about which they are in doubt. 
The procurement official should counsel the cardholder on the use of any required 
sources or existing contracts that must be used for their purchases. 

The cardholder must notify a local property officer (LPO) before or within a reasonable 
time after acquiring accountable, sensitive and/or hazardous personal property so that the 
property may be recorded in the proper system of record. This must be completed prior to 
placing the property item in service. Cardholders are required to report all costs of the 
property to the LPO. This means any cost associated with the acquisition of the item 
including, but not limited to, payments to vendors for freight, handling, storage, design, 
construction, and installation. (See Federal Accounting Standards Advisory Board 
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Number 6 for detailed information on acquisition cost.) The cardholder will provide the 
LPO with copies of written receipts and invoices (email copies are acceptable) to 
document each property transaction. The cardholder is also responsible for providing 
documentation of all costs as referenced above in order for the LPO to record these items 
correctly." 

With respect to disciplinary or administrative actions: 

Section 2.6 "The following discussion pertains to the Department's civilian employees. 
Members of the military service, employed by the United States Coast Guard, are subject 
to the Uniform Code of Military Justice and/or other appropriate administrative policies, 
rules, regulations or policies which are tailored and applicable to military personnel. 
Supervisors are responsible, and will be held accountable, for failing to monitor purchase 
card usage consistent with applicable law, rules, and procedures. Additionally, the DHS 
Office of the Chief Financial Officer and the DHS Office of the Inspector General (OIG) 
have and will exercise the right to monitor purchase card transactions on a constant 
basis. The OIG retains all audit and investigation authorities. The OIG and the CFO 
have access to an electronic system to monitor program operations and transactions on an 
ongoing basis. 

When using the purchase card, a CH must comply with all applicable statutory and 
regulatory provisions and federal and DHS prohibitions, controls, limitations, and 
approval requirements, with special attention to section 3.4 of this issuance (which 
contains examples of appropriate purchases) and section 3.8 (which covers use). 
Examples of unauthorized use or misuse include, but are not limited to, the following: 

1 . Using or authorizing the use of the purchase card, for other than official 
government business; 

2. Violating purchase card policies; 

3. Making purchases that do not meet the needs of the Government; 

4. Making false statements, submitting altered or false documents, or 
knowingly permitting such behavior in relation to the use of a Government 
purchase card; or, 

5. Negligence in performing official duties related to the use or approval of 
Government purchase cards. 

Each of these actions may be considered acts of abuse and attempts to commit fraud 
against the government, or other types of unacceptable conduct, or misconduct. 
Abuse and/or fraud will result in immediate cancellation of the employee's purchase 
card. In addition, the CH may be subject to disciplinary action np to and including 
termination of employment An employee also may be personally liable to the 
Government for die amount of any unauthorized transaction and may be subject to 
criminal prosecution. 

NOTE: In all situations where disciplinary action may be warranted, before any action is 
imposed, the servicing Employee Relations office must be consulted, along with the 
appropriate legal counsel's office, and, in some cases, the Office of the Inspector General 
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(OIG) to ensure consistency and fairness, that facts have been established, and that 
employees are given proper due process. " 

Recommendation 2: Improve the existing electronic systems to allow those with 
oversight responsibilities the ability to determine if cardholders and approving officials 
performed their reconciliation and certifying duties in a meaningful way. 

Response: 

DHS concurs with this recommendation but must point out that under the GS A SmartPay 
contract all electronic systems are provided by the contracting Bank. Changes in 
capabilities must be agreed to be implemented by the Bank based on the contract 
requirements and are therefore not necessarily going to be guided by agency requests. 
The costs associated with these systems changes sometimes outweigh the perceived 
benefit to the Bank of offering additional services. This may be something that can be 
negotiated with SmartPay2 scheduled to be bid in 2008. Our contractor U.S. Bank intends 
to augment its current reporting system by replacing the Customer Automation and 
Reporting Environment (C.A.R.E.) system with Access On-line sometime in the next 
fiscal year. It is not clear what additional capabilities will be included in this system but 
we are negotiating with them to add these capabilities. The current C.A.R.E. system does 
allow for daily reconciliations and history reports can be run ad hoc to record activity, but 
this requires manipulation of data files and report creation by OPCs that may be outside 
their current capabilities. Part of our retraining effort will also include C.A.R.E. and 
Access On-line system training for all card program participants. 

Recommendation 3: Conduct a review to determine if adequate resources are devoted to 
administering, maintaining, and enforcing the purchase card program at both the agency 
level and the organizational element level. DHS should further develop specific 
oversight responsibilities that need to be carried out at both the agency level and at the 
organizational element level. 

Response: 

The Office of the Chief Financial Officer plans to conduct reviews to determine if 
adequate resources are devoted to the purchase card program at both the agency and 
component level and develop oversight responsibilities for the program. This will be 
accomplished by the establishment of a Management Assurance Team that will conduct 
regular reviews of key programs, including the purchase card program. 

Recommendation 4: Adopt prudent purchasing practices by entering into arrangements 
with dependable sources in the government or vendors who can provide reasonable 
pricing for specific goods and services with a foreseeable demand in the event of an 
emergency. In anticipation of future emergencies, DHS should take the following 
actions: 
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• Identify specific sources in the federal government or vendors in the private sector 
that can reliably supply the necessary goods and services for DHS to accomplish 
its mission in emergency situations. 

• In the case of vendors in the private sector, negotiate pricing and delivery terms 
with these sources using the federal government's substantial purchasing power 
so that in a time of crisis DHS will be able to efficiently obtain the necessary 
goods and services. 

Response: 

DHS concurs with the GAO recommendation to procure emergency supplies and services 
efficiently from qualified vendors at the best possible prices. DHS is implementing this 
recommendation as part of the FEMA Re-tooling effort by establishing contractual 
relationships for known emergency supplies and services prior to a disaster so there 
should be fewer unplanned transactions. DHS is participating in the government wide 
forum to create standard procedures for emergency contracting and instituting training 
consistent with the new procedures, including training on the use of the Government 
Purchase Card during emergencies. These procedures standardize the process for 
required sources of supply and provide specific information on contractual vehicles that 
can be used to satisfy the emergency requirements. FEMA specifically has issued a field 
guide that also includes the required priority for sources of supply with the necessary 
information to order against pre existing contracts where appropriate. DHS Strategic 
Sourcing establishes DHS-wide contracting vehicles for commonly purchased supplies 
and services. For items such as office supplies, Strategic Sourcing has created DHS 
eMail that has demonstrated pricing savings and prompt delivery terms for standard 
government supplies. Similar contract vehicles may be established for emergency items 
where appropriate. 

Recommendation 5: Develop policies and procedures to limit approving officials' span 
of control. The number of cardholders and card accounts that any one approving official 
is responsible for should be reasonable and should be established in consideration of the 
approving official's other responsibilities. In addition, approving officials should have an 
appropriate number of transactions so that they may conduct a thorough and proper 
review of supporting documentation for each transaction. 

Response. 

The following language regarding span of control can be found in the recently issued 
Purchase Card Manual: 

Section I.5.G.3. The Organizational Program Coordinator (OPC) shall: "Determine the 
number of cardholders managed by each AO (A single individual may not be an AO for 
more than 7 CHs, or approve more than 300 transactions a month on a regular basis.)"; 
Sectionl.S.H.l. The Approving Official shall: "Provide approval, validation, oversight, 
and monitoring of purchase card activity over their designated cardholders. (A single 
individual may not be an AO for more man 7 CHs, or approve more man 300 transactions 
a month on a regular basis.)" 
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Recommendation 6: Continuously monitor and review open accounts to provide 
reasonable assurance that only cardholders who have a documented need to acquire items 
for the government are issued a purchase card. Instances where cards have not been used 
for over a year should be analyzed to determine if a valid need for the card exists. If a 
valid need can not be established, the purchase card should be suspended or the account 
closed. 

Response: 

DHS has contacted U.S. Bank to create a custom monthly report to capture this 
information and require monthly review by OPCs. 

Thank you again for the opportunity to comment on this draft report and we look forward 
to working with you on future homeland security issues. 



Sincerely, 




Director 

Departmental GAO/OIG Liaison Office 



(192192) 
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